@event4u/agent-config 8.7.0 → 8.9.0

package/dist/agent-src/rules/decision-revisit-gate.md

@@ -45,6 +45,14 @@ ceiling on what the package may ever become.
   `telegraph-speak`, thin-projector trimming) that rejects a change on
   cost grounds alone.
 - An ADR whose decision is being cited as a blocker for the current change.
+- A **hard structural cap** (kernel size, per-domain persona cap, rich-skill
+  ratio). A change that genuinely *qualifies* to cross the cap — e.g. a new
+  rule that truly meets the kernel-membership inclusion criteria — triggers a
+  **cap-raise proposal + maintainer/council approval**, never a silent
+  downgrade of the rule to fit the old number (e.g. demoting a must-always-fire
+  rule to `auto` just because the kernel says 9). Fitting the cap is not a
+  reason to weaken a qualifying rule; but a rule that does **not** meet the
+  criteria stays out — the cap is not the reason, the criteria are.
 
 ## What to do when it fires
 

package/dist/agent-src/rules/delegation-policy.md

@@ -72,6 +72,11 @@ primitive → run in-session (clean no-op).
    session (an application of the N=3 budget, no new mechanism); an ordered
    slice never dispatches before its declared parent's return is verified.
    Both per [`subagent-steering`](../contexts/execution/subagent-steering.md).
+6. **Record** telemetry after each dispatch — run `orchestration_record`
+   (one validated line: spawn_count, token_delta + provenance, tier, task_class)
+   per [`orchestration-telemetry`](../contexts/execution/orchestration-telemetry.md)
+   § Emit. Agent-behavioral capture the savings report reads; skipping it leaves
+   the value-of-orchestration question unmeasured.
 
 ## Scope — does NOT
 

package/dist/agent-src/rules/direct-answers.md

@@ -30,7 +30,7 @@ THE MORE LOAD-BEARING THE CLAIM, THE HARDER YOU VERIFY.
 WHEN VERIFICATION IS NOT WORTH THE COST → ASK.
 ```
 
-Severity tiers (High = load-bearing · Medium = project-shape · Low = idioms), per-tier verification actions, and "just guess" override: [`asking-and-brevity-examples`](../docs/guidelines/agent-infra/asking-and-brevity-examples.md).
+Severity tiers, per-tier verification actions, "just guess" override, **no duration estimates**, and **never cite the rule** when declining: [`asking-and-brevity-examples`](../docs/guidelines/agent-infra/asking-and-brevity-examples.md).
 
 **Live-state facts — never from memory.** Git/PR merge/branch/sync/existence state is High-severity and decays silently (branch already merged, PR already closed, `main` already ahead). NEVER assert "merged / not merged / pending / still open / already in `main` / out of scope" — or any branch/sync/existence claim — from memory, a roadmap note, an earlier turn, or a recalled memory. Run the live check FIRST (`git log --first-parent origin/main`, `git branch -r --contains <ref>`, `gh pr view <n> --json state,mergedAt,baseRefName`); a state question is self-answering (per [`git-workflow`](../skills/git-workflow/SKILL.md)). Same for any external system that changes behind you (CI run, deploy, remote queue).
 

package/dist/agent-src/rules/downstream-changes.md

@@ -77,3 +77,4 @@ After completing all downstream changes:
 2. **No broken tests** — run the project test suite (Pest / PHPUnit, Jest / Vitest, pytest, `go test ./...`, `cargo test`).
 3. **No broken types / signatures** — project's type-checker (PHPStan / Psalm, TypeScript, mypy / pyright, `go vet`, `cargo check`).
 4. **No stale references** — grep for the old name / namespace / import path to confirm zero results.
+5. **No own-orphans** — the same sweep applied to the new diff: identifiers whose last reference disappeared in a file this diff touched are removed in the same diff (see [`minimal-safe-diff § Own-orphan cleanup`](minimal-safe-diff.md#own-orphan-cleanup)); pre-existing dead code stays.

package/dist/agent-src/rules/external-code-graph-interop.md

@@ -0,0 +1,65 @@
+---
+type: "auto"
+tier: "2a"
+description: "When the repo ships an external code-graph index (a graph.json-shaped artifact or a SCIP index), query IT first for codebase-structure questions — do not grep from scratch"
+triggers:
+  - keyword: "scip"
+  - keyword: "code-graph"
+  - keyword: "code graph"
+  - phrase: "graph.json"
+  - phrase: "who calls"
+  - phrase: "call graph"
+  - phrase: "find references"
+  - phrase: "where is this used"
+applies_to_user_types:
+  - "developer"
+  - "maintainer"
+workspaces: [engineering]
+packs: [meta]
+---
+
+# External Code-Graph Interop
+
+Some repos commit a pre-built code-intelligence index — a `graph.json`-shaped
+artifact or a SCIP index (`index.scip`, `*.scip`). When one exists, it already
+answers "who calls X", "where is Y used", "what does this import" far more
+precisely than a fresh `grep`. This suite is an **orchestrator, not a
+competitor**: query the existing index first.
+
+## The rule
+
+```
+REPO SHIPS A CODE-GRAPH INDEX (graph.json-shaped OR a SCIP index)
+→ QUERY IT FIRST FOR CODEBASE-STRUCTURE QUESTIONS. GREP IS THE FALLBACK,
+NOT THE FIRST MOVE. NEVER REBUILD WHAT THE INDEX ALREADY ANSWERS.
+```
+
+## When it fires
+
+A codebase-structure question (call graph, references, usages, import graph)
+AND the repo contains a detectable index:
+
+- a SCIP index — `index.scip` or any `*.scip` at the repo root or a conventional
+  index directory;
+- a `graph.json`-shaped artifact (a committed code-graph export).
+
+## What to do
+
+1. **Detect** the index (its path is the concrete pointer; the specific tool
+   that produced it is named in the repo's own docs, not here).
+2. **Query it** for the relationship the user asked about.
+3. **Fall back to `grep`/read** only for what the index does not cover, and say
+   so ("the index has no entry for X, so I grepped").
+
+## When NOT to fire
+
+- No such index in the repo — normal `grep`/read is the right first move.
+- The question is about content/semantics, not code structure.
+
+## See also
+
+- [`discovery_graph`](../scripts/discovery_graph.ts) — this suite's OWN artefact
+  relation-graph (`affected`/`explain`); the external code-graph is the
+  *source-code* analogue this rule defers to for code questions.
+- [`think-before-action`](think-before-action.md) — analyze with the best
+  available tool before grepping blind.

package/dist/agent-src/rules/git-history-discipline.md

@@ -120,6 +120,24 @@ If either stop fires and resolution is not immediate → tag the state (`git tag
 
 `--amend` on the *current local* commit before the first push is the narrow exception (treated as continuing to compose the commit, not rewriting history).
 
+## Amend-after-hook-failure trap (data-loss)
+
+When a **pre-commit hook fails, the commit did NOT happen** — no new commit
+object was created. A reflexive `git commit --amend` at that point does not
+"retry the commit"; it rewrites the **previous, already-good** commit,
+destroying that work. This is the one place the narrow `--amend` exception
+above turns into data loss.
+
+Recovery — never amend after a hook failure:
+
+1. Read the hook output and **fix the cause** (the lint/test/format failure).
+2. **Re-stage** the fix (`git add`).
+3. Create a **NEW commit** (`git commit`, not `--amend`) — the prior commit was
+   never overwritten and must stay intact.
+
+Recovery procedures live next to this mechanism in
+[`skill:git-workflow`](../skills/git-workflow/SKILL.md).
+
 ## Why this rule exists
 
 Interactive rebase + fixup loops generate disproportionate token cost on every iteration: re-running CI per replayed commit, resolving the same content conflict in three derived files (`.condensation-hashes.json`, `dist/router.json`, `.windsurfrules`), losing the working tree to a stash that silently re-introduces older state. A single conflict can burn the budget of an entire feature.

package/dist/agent-src/rules/lethal-trifecta-guard.md

@@ -21,7 +21,11 @@ packs: [engineering-base]
 Prompt injection is not solvable at the model layer (OWASP LLM01). It is
 contained **architecturally**: a tool/skill/command becomes dangerous only when
 it combines all three legs of the *lethal trifecta*. Remove one leg and an
-injected instruction can do no consequential harm.
+injected instruction can do no consequential harm. This is the agentic attack
+surface OWASP's Agentic Security Initiative (ASI Top 10) catalogues — excessive
+agency, tool misuse, confused-deputy data exfiltration; the Least-Agency
+discipline in [`tool-safety`](tool-safety.md) is the same defence applied to the
+tool grant.
 
 ## The Iron Law
 
@@ -75,6 +79,7 @@ backstop.
 ## See also
 
 - [`untrusted-input-defense`](untrusted-input-defense.md) — data/instruction separation, spotlighting.
+- [`tool-safety`](tool-safety.md) — Least Agency: the narrowest tool grant breaks the egress leg by construction (OWASP ASI excessive-agency).
 - [`security-sensitive-stop`](security-sensitive-stop.md) — threat-model before editing a sensitive surface.
 - [`non-destructive-by-default`](non-destructive-by-default.md) — the human-in-the-loop egress floor.
 - [`threat-modeling`](../skills/threat-modeling/SKILL.md) — abuse-case enumeration.

package/dist/agent-src/rules/minimal-safe-diff.md

@@ -74,6 +74,54 @@ task scope · dependency bumps "because it was close to the cache".
 Ask. A minimal diff plus one follow-up is cheaper than a sprawling diff the
 reviewer has to untangle.
 
+## Anti-over-engineering
+
+The smallest change is also the least *abstract* and least *speculative* one:
+
+- **Three similar lines beat a premature abstraction.** Do not extract a helper
+  / generic / config layer to dedupe two or three call sites — inline
+  repetition is cheaper to read and change than the wrong abstraction. Per new
+  abstraction: **cite the second caller — or inline it.**
+- **No speculative features.** Nothing beyond what was asked: no
+  configurability or "flexibility" nobody requested, no parameters with one
+  call site, no error handling for scenarios that cannot occur in this
+  codebase.
+- **The rewrite trigger.** If the change could be half the size without losing
+  behavior, rewrite before presenting. Self-check: *"Would a senior engineer
+  call this overcomplicated?"* — if yes, simplify.
+- **No tombstones.** Delete removed code completely — no `_oldName` renames,
+  no `// removed X` / `// no longer used` markers, no dead re-export shims kept
+  "for safety". Git history is the tombstone.
+- **No docstrings/comments on untouched code.** Do not annotate code the diff
+  does not change.
+
+Wrong/right pairs for each ban:
+[`simplicity-and-goal-demos`](../docs/guidelines/agent-infra/simplicity-and-goal-demos.md)
+— the demos are the recognition surface; match your diff against the *right*
+column before presenting.
+
+**Not adopted (council):** the source's "validate only at system boundaries /
+trust internal code" clause is **rejected** — internal code can be wrong, and
+"trust" is not a testing strategy. Keep validating internal invariants; this
+fold is about *diff shape*, not about dropping internal checks.
+
+## Own-orphan cleanup
+
+Your diff cleans up exactly the mess it made — nothing more:
+
+- An identifier (import, variable, function, parameter) is an **own-orphan**
+  iff its **last reference disappeared in a file THIS diff touched**. Remove
+  it in the same diff — it traces to the task; leaving it is an incomplete
+  change, not restraint.
+- If **any reference survives in a file the diff did not touch**, the
+  identifier is **pre-existing debt** — leave it untouched and surface it via
+  [`active-remediation`](active-remediation.md)'s note-and-ask ladder, never
+  delete drive-by.
+- The check is mechanical: after editing, grep each identifier your hunks
+  stopped referencing; zero remaining references and the last one was yours →
+  own-orphan (delete); otherwise → note. (`downstream-changes` runs the same
+  sweep for renames — this is that sweep applied to the new diff.)
+
 ## Break-glass exception
 
 This rule stays in force during production incidents. "Break-glass mode"
@@ -98,4 +146,21 @@ After the incident, open a **follow-up PR** for any scope that was
 intentionally deferred and reference the break-glass commit in its
 description.
 
-See also: `scope-control` · `downstream-changes` · `think-before-action` · `preservation-guard` · `verify-before-complete`.
+## Bounded remediation carve-out
+
+The default stands: no drive-by edits, no opportunistic refactors. The one
+bounded exception — a **small, task-aligned security/correctness fix in code
+the current task already touches** — is governed by
+[`active-remediation`](active-remediation.md). It is permitted inline **only**
+when ALL hold: same request path / module, ≤ ~10 changed lines in one
+production file (plus its test file), no public-API / response-shape change, no dependency bump or migration,
+and its verification (e.g. the negative test) ships in the same commit.
+Anything outside those five conditions is **not** this carve-out — it is
+note + ask per `active-remediation`. This never licenses reformatting,
+renames, dependency bumps, or version upgrades (a syntax-idiom modernization
+is allowed only under `active-remediation`'s version-gated, behavior-preserving
+clause; a dependency/version bump stays ask-only). The sole case that may
+interrupt is a **live cross-user/tenant data exposure** ([`broken-access-control`](broken-access-control.md)) —
+fix-now-if-small, else stop and surface; never defer it silently.
+
+See also: `scope-control` · `downstream-changes` · `think-before-action` · `preservation-guard` · `verify-before-complete` · [`active-remediation`](active-remediation.md) · [`broken-access-control`](broken-access-control.md).

package/dist/agent-src/rules/non-destructive-by-default.md

@@ -32,9 +32,12 @@ Triggers below require explicit user confirmation **on this turn** — not from
 | **Production data / infra** | prod DB writes / migrations, prod config, secrets rotation, IAM / role / policy, DNS, anything in a `prod`-scoped path or pipeline |
 | **Whimsical / unscoped bulk deletion** | `rm -rf <dir>`, `git rm -r`, glob deletes, `DROP TABLE`, `TRUNCATE`, `git reset --hard` past unpushed work — when **not required** by the task (task-aligned WIP deletions allowed, below) |
 | **Commit containing bulk deletions or infra changes** | diff removes a directory, deletes ≥5 unrelated files, or touches Terraform/Pulumi/k8s/Ansible/cloud-config — surface the diff + confirm even when [`commit-policy`](commit-policy.md) authorizes |
+| **Irreversible external action** | **send** / **publish** / **post** / **purchase** / **submit** — an outbound, externally-visible, or money-moving action the user cannot un-see: send an email/message, publish or post content, submit a form, place an order or payment. Also gated by [`scope-control`](scope-control.md) external-comms; named here so the Hard Floor lists the actual buttons |
 
 Standing "just keep going" + next step crosses the floor → STOP, surface it (one numbered-options block per [`user-interaction`](user-interaction.md)), wait.
 
+**Never act while asking.** The ask and the action are strictly sequential: surface the confirmation, then WAIT for the answer. Never fire the action in the same turn you ask for it — no do-then-ask race, no "I went ahead and…". **The approval names the exact object** so the user confirms the real thing, not a category: a download names filename + size + source; a purchase names amount + card-last4 + total; a send names recipient + subject. Shape per [`user-interaction`](user-interaction.md) numbered-options.
+
 ## Not in scope — deterministic regeneration
 
 Output regenerated from a tracked source (condensation, code-gen, formatters, lock-files) is reversible — **not destructive** ([`autonomous-execution`](autonomous-execution.md)). Per-file diff approval is theater.

package/dist/agent-src/rules/prefer-enums-over-literals.md

@@ -0,0 +1,65 @@
+---
+type: "auto"
+tier: "2b"
+alwaysApply: false
+description: "Modeling a field/property with multiple non-boolean states — prefer an enum over bare string/numeric literals; found old-style literals where an enum fits → note, finish the task, ask after"
+triggers:
+  - intent: "modeling a field with multiple states"
+  - intent: "adding a status or type field"
+  - keyword: "enum"
+  - keyword: "status"
+  - keyword: "kind"
+  - keyword: "category"
+  - keyword: "migration"
+workspaces: [engineering]
+packs: [engineering-base]
+---
+
+# Prefer Enums Over Literal Values
+
+When a field/property holds **two or more non-boolean states** — strings (`'active'`, `'pending'`, `'archived'`) or meaningful numeric codes (priority `1`/`2`/`3`, tier levels) — model it as an **enum**, not a bare string/int. An enum names the value in code (readable), makes it greppable + safe to rename, gives exhaustiveness/typo safety, and makes filtering + editing relations far easier than raw literals scattered across the codebase.
+
+## The Iron Law
+
+```
+A FIELD WITH MULTIPLE NON-BOOLEAN STATES IS AN ENUM, NOT A BARE STRING OR MAGIC NUMBER.
+NAME THE VALUE IN CODE — NEVER SCATTER RAW LITERALS ('active', 2, 'PENDING') ACROSS THE CODEBASE.
+FOUND OLD-STYLE LITERALS WHERE AN ENUM FITS? NOTE IT, FINISH THE TASK, THEN ASK — NEVER REFACTOR MID-FLOW.
+```
+
+## Prefer an enum when
+
+- A multi-state **string** field — `status`, `type`, `role`, `kind`, `category`, `state` — with 2+ distinct values.
+- A **numeric code that is a label, not a quantity** — priority `1/2/3`, severity levels, tiers.
+- Any **closed set of values the code branches on** (`match` / `switch` / `if ===`).
+
+## Do NOT force an enum when
+
+- A boolean (`true`/`false`) — a flag, not an enum.
+- Open/unbounded free text — name, description, URL, comment.
+- A genuine numeric **quantity** used in arithmetic — price, count, age, bytes.
+- A set owned entirely by a volatile external system — unless you map it to your own enum at the boundary.
+
+## How (framework-neutral)
+
+- Use the language's native construct: backed enum (PHP `enum Status: string`), string-literal union or `enum` (TypeScript), `enum.Enum` (Python), an enum/`CHECK`-constrained column or lookup table + FK (database).
+- Persist the enum's backing value; reference the **named case** in code, never the raw literal.
+
+## Found old-style literals where an enum fits — defer, do not disrupt
+
+Apply exactly this order so the current task's flow is never interrupted:
+
+1. **While doing the actual task**, if you pass code using raw string/numeric literals for a multi-state field where an enum fits, do **NOT** refactor inline (a drive-by edit — see `minimal-safe-diff`) and do **NOT** stop to ask mid-flow.
+2. **Note the site** — file:line + the literal set — in your working notes.
+3. **After the actual task is delivered**, surface the noted candidates as **one** numbered-options prompt (per `user-interaction`): list each enum-candidate site, ask whether to replace — all / selected / none.
+4. **Only on an explicit yes** do you refactor, as a **separate change** with its own scope (`downstream-changes` applies — update every caller, migration, test, serializer).
+
+If the task itself is *adding* the field, apply the enum from the start — no deferral; the defer-and-ask flow is only for pre-existing literals you encounter.
+
+## See also
+
+- [`improve-before-implement`](improve-before-implement.md) — the Strategy sniff test when a second branch on the same enum/string discriminator signals the enum should become a Strategy (`docs/guidelines/php/patterns/strategy.md`).
+- [`minimal-safe-diff`](minimal-safe-diff.md) — why you don't drive-by-refactor the literals you find.
+- [`scope-control`](scope-control.md) — replacing an existing pattern needs the user's yes first.
+- [`active-remediation`](active-remediation.md) — the general fix-now / note-and-ask / follow-up-PR ladder; the enum defer-and-ask above is one instance of it.
+- [`senior-engineering-discipline`](senior-engineering-discipline.md) — the "generalize, don't overfit" anchor this extends.

package/dist/agent-src/rules/question-not-instruction.md

@@ -0,0 +1,76 @@
+---
+type: "auto"
+tier: "1"
+description: "A question is a request for an ANSWER, never authorization to act — answer first; never treat 'why…?' / 'can you…?' / 'what do you think?' as a green light to build, change, or execute"
+triggers:
+  - phrase: "warum"
+  - phrase: "wieso"
+  - phrase: "weshalb"
+  - keyword: "why"
+  - phrase: "what do you think"
+  - phrase: "was denkst du"
+  - phrase: "was hältst du"
+  - phrase: "geht das"
+  - phrase: "kannst du"
+  - phrase: "sollte ich"
+  - phrase: "should i"
+  - phrase: "is it possible"
+applies_to_user_types:
+  - "creator"
+  - "developer"
+  - "maintainer"
+  - "operator"
+  - "researcher"
+workspaces: [engineering]
+packs: [meta]
+---
+
+# Question Is Not an Instruction
+
+```
+A QUESTION ASKS FOR AN ANSWER. IT IS NOT AUTHORIZATION TO ACT.
+"WARUM…?" / "WHY…?" / "WAS DENKST DU?" / "GEHT DAS?" / "KANNST DU…?"
+→ ANSWER FIRST. NEVER BUILD, CHANGE, COMMIT, OR EXECUTE ON A QUESTION.
+RUNNING OFF ON A QUESTION IS A RULE VIOLATION, NOT INITIATIVE.
+```
+
+The user asks two distinct kinds of turn. Confusing them is the failure this
+rule exists to stop:
+
+| Turn shape | Signal | Correct response |
+|---|---|---|
+| **Question** | interrogative — `warum`, `wieso`, `why`, `?`, `was denkst du`, `geht das`, `kannst du`, `sollte ich`, `is it possible` | **Answer it.** Explain, reflect, surface the trade-off. Do NOT execute. |
+| **Instruction** | imperative — `mach`, `bau`, `implementiere`, `fix`, `erstelle`, `run`, `füge hinzu` | Execute per the usual authority gates. |
+
+## The trap
+
+A question that expresses **frustration or challenge** — *"Warum hast du nur
+eine Phase gemacht?"*, *"Wieso hast du das nicht anders gelöst?"* — is STILL a
+question. It demands an explanation, not a burst of corrective action. Reading
+the frustration as *"go fix everything now"* and charging off is the canonical
+violation: the user loses their answer AND gets unrequested work.
+
+## What to do
+
+1. **Answer the literal question** — directly, honestly, first token.
+2. If the answer implies work *might* follow, **stop after the answer** and let
+   the user decide. Offer numbered options if a decision is genuinely theirs
+   (per [`user-interaction`](user-interaction.md)), but do not start the work.
+3. Only a subsequent **imperative** turn authorizes execution.
+
+## When it does NOT fire
+
+- The turn is imperative (an instruction), even if phrased politely
+  (*"kannst du bitte X machen"* where X is clearly the ask + context makes it a
+  directive) — but when genuinely ambiguous between question and instruction,
+  treat it as a **question** and ask which the user meant (one line).
+- A rhetorical question inside a larger instruction (*"why not just do X? do
+  it"*) — the trailing imperative governs.
+
+## See also
+
+- [`user-interrupt-priority`](user-interrupt-priority.md) — a new *instruction*
+  mid-flight; this rule is its complement for a *question* mid-flight.
+- [`ask-when-uncertain`](ask-when-uncertain.md) — when the agent should ask;
+  this rule is about honouring the user's question, not the agent's.
+- [`direct-answers`](direct-answers.md) — answer the substance, no deflection.

package/dist/agent-src/rules/senior-engineering-discipline.md

@@ -0,0 +1,82 @@
+---
+type: "auto"
+tier: "2b"
+alwaysApply: false
+description: "Writing/generating code — generalize (no overfit or tautological tests), supply the invisible cross-cutting controls the prompt didn't name, never invent an API/field/package"
+triggers:
+  - intent: "writing or generating code"
+  - intent: "implementing a feature"
+  - keyword: "implement"
+  - keyword: "endpoint"
+  - keyword: "query"
+  - keyword: "migration"
+  - keyword: "component"
+  - keyword: "seeder"
+  - keyword: "dependency"
+  - keyword: "refactor"
+routes_to:
+  - "skill:ai-code-blindspots"
+  - "skill:frontend-render-security"
+  - "skill:supply-chain-intake"
+  - "skill:testing-anti-patterns"
+workspaces: [engineering]
+packs: [engineering-base]
+---
+
+# Senior Engineering Discipline
+
+Dominant failure mode of AI-written code isn't ignorance — **omission**. Model writes happy-path code satisfying the literal task + passing shallow tests, silently drops the invisible cross-cutting controls a senior supplies from unstated context. Baseline (2025 studies): a large share of AI-generated code ships a known vulnerability even at high syntax-correctness, and automation bias makes devs trust it *more* while it's *less* safe. Write like a senior: general not overfit; invisible controls present; verified against real sources, not memory. Act like a senior **owner**, not a passive typist — work in the interest of the product, the user, and the company, especially on security and quality; see a problem → react (fix it if small and task-aligned, else ask — per [`active-remediation`](active-remediation.md)) — never look away.
+
+## The Iron Law
+
+```
+CODE AND TESTS EXPRESS THE GENERAL RULE — NEVER OVERFIT TO A FIXED CASE.
+SUPPLY THE INVISIBLE CROSS-CUTTING CONTROLS THE PROMPT DID NOT NAME.
+NEVER INVENT AN API, FIELD, OR PACKAGE — VERIFY IT AGAINST A REAL SOURCE.
+THE HAPPY PATH THAT PASSES ONE TEST IS NOT A FINISHED CHANGE.
+```
+
+## Three obligations, every time you write code
+
+### 1. Generalize — never overfit
+
+- Implementation expresses the general rule, not a special case that happens to satisfy the example. Don't hardcode a derivable value; don't branch on one literal where a rule covers all inputs; don't paste a near-duplicate where an existing abstraction fits.
+- Tests assert **general behavior**, never a fixed value or narrow regex passing only for one crafted input. Derive expected from inputs + seeded/random data — never hardcode what the code emits. Cover happy **and** boundary (empty / null / max / Unicode) **and** error **and**, on security paths, an abuse case. Lone happy-path assertion = tautology. → `skill:testing-anti-patterns`.
+
+### 2. Cover the invisible controls for what you touched
+
+Before done, assert the unmentioned cross-cutting control is present, matched to surface:
+
+- **endpoint / route** → authorization + tenant scope + input validation + rate limit; state-changing → CSRF + audit. (`security-sensitive-stop` gates the sensitive ones.)
+- **database query / migration** → parameterized (never string-built), tenant-scoped, transaction around multi-step writes, reversible migration (expand-contract, never bare `DROP`), index on filtered / FK columns.
+- **user-controlled render** → output-encode; never `dangerouslySetInnerHTML` / `v-html` / `innerHTML` / `eval` on non-constant input; no secret / token in client code. → `skill:frontend-render-security`.
+- **file / outbound fetch** → path-confinement + SSRF allow-list; validate server-side, never client-only.
+- **infra / IaC** → least-privilege (no `Action:*` / `Resource:*`), encryption at rest, no `0.0.0.0/0` to mgmt / DB ports, no hardcoded creds; real scanner (Checkov / Trivy) is the backstop — `plan` succeeding isn't.
+- **new dependency** → verify it exists on the real registry before install (hallucinated / "slopsquatted" packages ~1 in 5 AI suggestions); pin + lockfile; CVE scan. → `skill:supply-chain-intake`.
+
+Full surface→controls table + backstop greps: → `skill:ai-code-blindspots`.
+
+### 3. Verify — never assert from memory
+
+No completion claim without exercising the real path (running endpoint / UI / test — not "the code looks right"). "Defined but not wired" (middleware written, never connected to the route) = **not done**. **Before pushing code / opening a PR, run a changed-files static pass — type-checker + linter scoped to the diff (`tsc --noEmit` on the touched project, linter on changed files) — even when `quality.local_auto_run` is false: a narrow probe of your own diff, NOT the suppressed full pipeline. Letting a compile/lint error hit remote CI = completion claim without evidence (the beginner error this guards).** → `verify-before-complete`, `source-discovery-gate`.
+
+## When it fires
+
+Any turn that writes, generates, or modifies code — feature, endpoint, query, migration, component, test, seeder, dependency, infra resource.
+
+## When NOT to fire
+
+- Prose / docs / config-only edits, no code behavior.
+- One-line rename / typo / formatting.
+- User fenced the scope ("just this one line", "skip the checks").
+
+## Relationship to existing rules
+
+Cross-cutting **anchor**; depth lives elsewhere and this routes to it. Doesn't replace `security-sensitive-stop` (threat-model before editing auth / billing / tenant / secret paths), `minimal-safe-diff` (smallest change), `think-before-action` (analyze first), `downstream-changes` (update all callers), `output-discipline` (no placeholder / TODO code). When one fires it wins on its subject; this adds the "generalized + invisible controls?" gate on top.
+
+## See also
+
+- [`ai-code-blindspots`](../skills/ai-code-blindspots/SKILL.md) — surface→controls checklist + backstop greps.
+- [`frontend-render-security`](../skills/frontend-render-security/SKILL.md), [`supply-chain-intake`](../skills/supply-chain-intake/SKILL.md) — the two precision gaps.
+- [`testing-anti-patterns`](../skills/testing-anti-patterns/SKILL.md) — overfit / tautological assertions + test-data realism.
+- [`security-sensitive-stop`](security-sensitive-stop.md), [`engineering-safety-floor`](engineering-safety-floor.md), [`verify-before-complete`](verify-before-complete.md), [`source-discovery-gate`](source-discovery-gate.md).

package/dist/agent-src/rules/think-before-action.md

@@ -33,6 +33,7 @@ NO BLIND TRIAL-AND-ERROR. MAX 2 RETRIES PER APPROACH.
 - Prefer targeted inspection (jq, debugger, logs) over brute-force.
 - Always verify results after changes (API, UI, tests) using the concrete tool that exercises that surface — `curl` / Playwright / browser for HTTP and UI, debugger / `xdebug` for runtime frames, the project's test runner for behavior.
 - When behavior can be defined → prefer test-first / TDD.
+- **Multi-step task → restate as verifiable success criteria first** (test that reproduces the bug, failing-then-passing check, before/after invariant) and plan `step → verify:` per step; a task whose success cannot be checked is a clarification trigger, not an execution trigger. Transformation table: [`think-before-action-mechanics § Goal-driven execution`](../contexts/communication/rules-auto/think-before-action-mechanics.md#goal-driven-execution--vague-ask--verifiable-goal).
 - Unclear requirements → precise clarification question, not hidden assumptions.
 - Refactors must preserve behavior, validation, examples, and anti-failure guidance unless explicitly changed.
 - Do NOT modify code you do not fully understand — read it, trace the flow, then change it.

package/dist/agent-src/rules/tool-safety.md

@@ -16,6 +16,8 @@ packs: [meta]
 
 Tools are permissions, not abilities. Every tool access must be declared and reviewable.
 
+**Least Agency** — grant the narrowest set of tools, scopes, and consequential actions the task needs; fewer capabilities per path = smaller blast radius when something (prompt injection, confused-deputy step, bug) goes wrong. Agent-tool application of least-privilege; maps to OWASP Agentic Security Initiative (ASI) excessive-agency / permission-management risks. In doubt, deny and ask — don't grant and hope.
+
 ## Constraints
 
 - **Deny by default** — no tool access unless explicitly listed in `allowed_tools`
@@ -43,3 +45,9 @@ If a skill needs a tool that is not in the registry:
 - Internal agent capabilities (file reading, code analysis) — these are not external tools
 - MCP server configuration — handled by the `mcp` skill
 - Credential management — handled by environment configuration
+
+## See also
+
+- [`lethal-trifecta-guard`](lethal-trifecta-guard.md) — an over-broad tool grant is the standing egress leg of the lethal trifecta (OWASP ASI). Least Agency breaks that leg by construction.
+- [`supply-chain-intake`](../skills/supply-chain-intake/SKILL.md) — the MCP-server intake gate applies this Least-Agency tool-grant review before a new server is connected.
+- [`untrusted-input-defense`](untrusted-input-defense.md) — the least-agency + human-approval controls (OWASP LLM06 / ASI excessive-agency) that bound an untrusted-content path.