@event4u/agent-config 8.9.0 → 8.11.0

package/dist/agent-src/rules/autonomous-execution.md

@@ -29,9 +29,7 @@ Three values: `on` (suppress trivial questions), `off` (ask trivial questions to
 
 ## Opt-in detection — match by intent, not exact string
 
-In `auto` mode, flip to `on` for the rest of the conversation when the user expresses **"stop asking on trivial steps, just work"**. Recognize **intent**, not the literal substring. Opt-out (same intent, reversed) flips back to `off`. Both directions are **speech-act-checked**: the phrase must be a meta-instruction to the agent, not content / quote / subject / code / third-party reference / hypothetical. In doubt → keep current mode, no speculative flips.
-
-Algorithm and speech-act heuristic: [`contexts/execution/autonomy-detection.md`](../contexts/execution/autonomy-detection.md). Anchor phrases (DE+EN), no-flip patterns, counter-examples, trivial-vs-blocking taxonomy, commit-policy summary, and named failure modes: [`contexts/execution/autonomy-mechanics.md`](../contexts/execution/autonomy-mechanics.md) + [`contexts/execution/autonomy-examples.md`](../contexts/execution/autonomy-examples.md).
+In `auto` mode, flip to `on` when the user expresses **"stop asking on trivial steps, just work"** — matched by intent, speech-act-checked, reversible; in doubt → no speculative flips. Algorithm: [`contexts/execution/autonomy-detection.md`](../contexts/execution/autonomy-detection.md); summary + anchor phrases + taxonomy: [`contexts/execution/autonomy-mechanics.md`](../contexts/execution/autonomy-mechanics.md) + [`contexts/execution/autonomy-examples.md`](../contexts/execution/autonomy-examples.md).
 
 ## Task-scope — autonomy is bound to the named task
 
@@ -41,22 +39,7 @@ DOES NOT CARRY OVER TO A DIFFERENT, LATER DELIVERABLE.
 NEW TASK → FRESH CONFIRMATION.
 ```
 
-Two distinct autonomy shapes — keep them apart:
-
-| Shape | Trigger | Scope |
-|---|---|---|
-| **Conversation-wide trivial-question suppression** | "stop asking on trivial steps, just work" — no deliverable named. | Sticky for the rest of the conversation. Suppresses trivial workflow questions only; never lifts blocking, Hard Floor, or [`scope-control`](scope-control.md) gates. |
-| **Task-scoped autonomous execution** | "work autonomously on X", "arbeite die Roadmap Y komplett ab", "do PROJ-123 end-to-end" — a deliverable / artifact / ticket is named. | Bound to **that** task. Ends when the task ends. Does **not** authorize starting a new, distinct task autonomously. |
-
-Litmus test: does the directive name (or unambiguously point to) a single concrete deliverable? Yes → task-scoped, scope ends with the deliverable. No → conversation-wide, trivial-question suppression only.
-
-When the user later issues a **new** request — different ticket, different roadmap, different artifact, different feature — treat it as a fresh task. Re-confirm autonomy for the new scope before:
-
-- creating a branch / worktree / PR / tag for the new work,
-- implementing a roadmap whose **authoring** was the prior turn's deliverable (per [`scope-control § authoring vs implementation`](scope-control.md#authoring-vs-implementation--verb-discipline)),
-- expanding scope beyond the new task's literal ask.
-
-In doubt whether the new request inherits or needs fresh confirmation → fresh confirmation. The Hard Floor and [`scope-control`](scope-control.md) gates apply to every task regardless.
+Litmus: does the directive name a single concrete deliverable? Yes → task-scoped, ends with the deliverable; no → conversation-wide trivial-question suppression only. Shapes table, re-confirmation triggers, and the in-doubt default: [`autonomy-mechanics § Task-scope`](../contexts/execution/autonomy-mechanics.md).
 
 ## User interrupts override the current task
 
@@ -64,7 +47,7 @@ A new instruction from the user mid-flight is **not** a continuation — see [`u
 
 ## Validation-loop budget — hard cap N=3 per target
 
-Autonomous flows must not iterate indefinitely on the same validation target. **Validation target** = a single identifiable artefact: a file path, a lint rule ID, a test name, a CI sub-task name. Natural-language clustering ("the linter stuff") does **not** count as a target — agents will rename their way out of the budget.
+**Validation target** = a single identifiable artefact (file path, lint rule ID, test name, CI sub-task name) — natural-language clusters ("the linter stuff") don't count.
 
 ```
 3 CONSECUTIVE FAILED ATTEMPTS ON THE SAME VALIDATION TARGET → STOP.
@@ -73,7 +56,7 @@ DO NOT ITERATE BEYOND N=3 WITHOUT EXPLICIT USER APPROVAL.
 COUNTER RESETS ONLY ON A DIFFERENT TARGET OR USER-APPROVED CONTINUATION.
 ```
 
-A "failed attempt" is an iteration that did not move the target from red to green. Tuning the tool around the target (e.g. growing an allowlist, loosening a threshold, suppressing a check) counts as an attempt — and is usually a sign the **tool**, not the content, is wrong.
+Failed attempt = an iteration that did not move the target red → green; tuning the tool around the target counts as an attempt.
 
 ### Antipattern — allowlist-growth as silent budget bypass
 
@@ -82,23 +65,10 @@ ALLOWLIST > 20 ENTRIES IN ONE SESSION = THE LINTER IS WRONG.
 STOP. PROPOSE LINTER REDESIGN OR REMOVAL. DO NOT EXPAND THE ALLOWLIST FURTHER.
 ```
 
-Crossing the 20-entry threshold counts as the 3rd validation-target failure for the linter in question, regardless of prior attempt count. The fix is a tool-shape change (heuristic tightening, scope narrowing, deletion), not more entries. Same logic for: warning-suppression lists growing past ~20, `// noqa` / `# type: ignore` sweeps over many files in one session, test `skip` / `xfail` bulk-adds to chase green.
-
-### Probe efficiency — direct over orchestration
-
-When validating a single target, run the **specific** check, not a meta-task that fans out to dozens of sub-tasks. Use the failing tool's direct entry point (the specific script invocation, the specific runner target, the single-test filter for the project's test runner) rather than the full CI meta-pipeline. Full-pipeline runs are appropriate at phase boundaries, not as a per-iteration probe.
-
-Concrete tool mapping — verify with the narrowest tool that proves the target green: a single `curl` / Playwright spec / browser run for HTTP behavior, the project's test runner with a `--filter` for one test, a debugger / `xdebug` step-through for one frame. Never substitute a meta-pipeline for a tool that pinpoints the failure.
-
-## Adaptive effort & stop (RDP)
+Crossing 20 entries counts as the 3rd validation-target failure — fix the tool shape, not the list. Verify with the narrowest tool that proves the target green (a single `curl` / Playwright spec for HTTP/UI, the test runner with a `--filter`, an `xdebug` step-through) — never a meta-pipeline as per-iteration probe. Failed-attempt detail, suppression-sweep equivalents, probe-efficiency detail, and adaptive effort & stop (RDP): [`autonomy-mechanics § Validation-loop budget`](../contexts/execution/autonomy-mechanics.md).
 
-Scale effort to task difficulty, and stop when marginal evidence drops — coupled
-to the N=3 budget above, never replacing it. On a host with a native effort knob
-(e.g. an `effort` parameter), the right move is to **set it high** for hard tasks
-rather than scaffold; the scaffold here is for a standard host **without** such a
-knob. The per-dimension uncertainty score (see
-[`notes-first-reasoning`](notes-first-reasoning.md)) feeds this decision. Engage
-per [`rdp-gate`](../contexts/execution/rdp-gate.md).
+Body migrated to `contexts/execution/autonomy-mechanics.md` (per P4 of `road-to-kernel-and-router.md`) — opt-in detection summary, task-scope shapes table, N=3 mechanics, allowlist-antipattern detail, probe efficiency, adaptive effort (RDP).
+Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 ## See also
 

package/dist/agent-src/rules/broken-access-control.md

@@ -25,7 +25,7 @@ packs: [engineering-base]
 
 # Broken Access Control
 
-The most common — and most damaging — failure in real systems and AI-written code: log in as one user, see another user's data. **Authenticated ≠ authorized.** The login check passes so the endpoint *feels* protected; the per-object ownership/tenant check is a separate line devs and AI omit — especially when the object id comes from the request. OWASP Web #1 (A01:2021) and API #1 (BOLA/IDOR), trivially scriptable, and a recurring real-world breach class — e.g. First American Financial (885M documents exposed via sequential ids with no ownership check).
+The most common — and most damaging — failure in real systems and AI-written code: log in as one user, see another user's data. **Authenticated ≠ authorized** — the per-object ownership/tenant check is the separate line devs and AI omit, especially when the object id comes from the request (OWASP Web #1 A01:2021 / API #1 BOLA/IDOR).
 
 ## The Iron Law
 
@@ -38,16 +38,6 @@ ROLE DECIDES WHICH FIELDS — THE SERVER STRIPS THEM. THE FRONTEND HIDING A FIEL
 A LIVE CROSS-USER EXPOSURE IS A NOTIFIABLE BREACH — NEVER SILENTLY PATCH IT.
 ```
 
-## Non-optional controls (every data-returning surface)
-
-- **Server-derived principal.** Ownership/tenant derived from the session/token, **never** from a request header/param/body the caller controls. A matching id in the request is not authorization.
-- **Ownership/tenant check on every request id** before returning data. `findById(params.id)` with no `where owner/tenant = currentPrincipal` is the canonical bug.
-- **Tenant-scoped by construction.** Every query on a tenant table carries the tenant predicate; prefer a base scope that injects it so a forgotten clause can't leak. (DSGVO: Mandantentrennung / Trennungskontrolle is a required TOM — a missing `tenant_id` filter is a compliance failure, not just a bug.)
-- **Response minimization.** Return only entitled fields — no `SELECT *` / full-object serialization leaking PII "because the model has it" (Art. 25(2)).
-- **Property-level authz (BOPLA / mass assignment).** Reject `role` / `user_id` / `tenant_id` / `is_admin` from the request body; explicit field allow-list, never whole-body binding.
-- **Role/field-level output filtering (vertical BOPLA).** *Which* fields a principal receives depends on role + business rules — a driver role must not receive `price`; an office role must not receive the boss's `offer`. Serialize via a **role-scoped output DTO**, never the raw model / `to_json()`; sensitive fields (`price`/`cost`/`margin`/`salary`/`discount`/`offer`/internal notes) default-deny per role.
-- **No guessable public ids** on sensitive resources — UUID/ULID, not sequential integers (turns one bug into full-DB enumeration).
-
 ## The three negative tests — the completion gate
 
 A protected endpoint is **not complete** until these exist and pass (happy-path 200 alone is the tautology this rule stops):
@@ -56,38 +46,7 @@ A protected endpoint is **not complete** until these exist and pass (happy-path
 2. **authenticated but not the owner → 403/404** (user A requests user B's object with A's token).
 3. **cross-tenant → 403/404** (a principal in tenant A requests tenant B's resource; prefer 404 on sensitive resources — a hard 403 confirms the id exists in another tenant).
 
-Small + task-aligned gap in code you touched → add the check **and** its negative test in the same commit (auto-fix boundary in `active-remediation`). Bigger → surface it.
-
-## Role-based field-level access — both directions (vertical BOPLA + BFLA)
-
-Object-ownership (above) is *horizontal* (may this principal touch this record). This is *vertical*: which **fields** and which **functions** a role may reach — the maintainer's case (driver ≠ price, office worker ≠ boss's offer). Depends on role + business rules, and **the server is the only boundary** — the frontend hiding a field does not protect it: the raw JSON on the wire is readable via `curl`/DevTools/a proxy (3Fun leak: a privacy toggle filtered only in the app; the server returned every user's location to a direct query).
-
-- **Read side (CWE-213 / Excessive Data Exposure).** Build the response from a **role-scoped output DTO** — never serialize the ORM model directly. Sensitive fields default-deny per role. A client `?fields=` selection is ergonomics, not authorization — intersect it server-side with the role's read-allowlist.
-- **Write side (CWE-915).** Bind input through a **role-scoped write-allowlist** — never the raw body. Read-allowed ≠ write-allowed: a role may *see* `status` but not *set* `status:"approved"`; two independent sets.
-- **Function level (BFLA, OWASP API #5).** A role must not reach a function/verb reserved for a higher role. Gate **every mutating verb** (POST/PUT/PATCH/DELETE), deny-by-default — not just the GET you were asked about. The admin button being hidden is not a control.
-- **Nested / GraphQL.** Field-level checks propagate to nested selections; a low-role token selecting a restricted field gets null/error, not data.
-- **Negative tests, per (role × sensitive field), both directions:** lower-role token → the field is **absent from the raw response body** (assert the body, not the UI); lower-role setting it on input → rejected/ignored, **verified by re-reading the persisted record**; every privileged verb → 403 for lower roles (403/404 on sensitive object reads).
-
-## Defense-in-depth (so one miss can't leak)
-
-Stack ≥2 independent layers on sensitive data — query-level ownership scoping, a centralized default-deny policy layer (a route with no policy is denied, not silently open), and DB row-level security as the backstop for a forgotten `WHERE tenant_id`. The RLS / policy-layer configuration, the per-role authz matrix, and the audit greps live once in [`authz-review`](../skills/authz-review/SKILL.md).
-
-## GDPR / DSGVO — data protection by design
-
-A cross-user leak violates **Art. 5(1)(f)** (integrity & confidentiality — a principle → higher fine tier), **Art. 25** (by design/default: default-deny + least privilege + response minimization), and **Art. 32** — which also **mandates a process for regularly testing effectiveness** of these controls (untested authz is a direct Art. 32 gap; hence the three negative tests are non-optional). A discovered live exposure is a **notifiable breach** (Art. 33, 72 h from discovery) — surface as "notify + remediate", never a silent patch. Data-protection context, not legal advice → `privacy-review`, `domain-safety-pii`.
-
-## Backstop greps (authoring-time)
-
-```bash
-# Record fetched by request id with no owner/tenant predicate nearby (high-noise — a hit means read the line, not auto-fix)
-rg -n '(findById|find|findOne|get)\(\s*(req\.|request\.|params\.|\$request|\$id)'
-# Client-supplied tenant/user hint used as the scope (should come from the session)
-rg -n '(tenant|tenantId|user_id|userId)\s*=\s*(req|request|params|headers|query)\.'
-```
-
-The full authoring-time grep set (mass-assignment, raw-serialization, secrets) lives once in [`ai-code-blindspots`](../skills/ai-code-blindspots/SKILL.md).
-
-A hit means read that line — is the ownership/tenant check present? Some are safe (already scoped); none should ship unchecked.
+Small + task-aligned gap in code you touched → add the check **and** its negative test in the same commit (see `active-remediation` for the auto-fix boundary). Bigger → surface it.
 
 ## When it fires
 
@@ -95,12 +54,15 @@ Writing/modifying any endpoint, route, query, or serializer returning user- or t
 
 ## When NOT to fire
 
-- Public, non-user-specific data with no principal concept (public docs page, health check with no data).
+- Public, non-user-specific data with no principal concept (a public docs page, a health check with no data).
 - Prose/docs/config-only edits.
 
+Body migrated to [`skill:authz-review` § Broken-access-control depth](../skills/authz-review/SKILL.md) (per P4 of `road-to-kernel-and-router.md`) — non-optional controls, role-based field-level access (vertical BOPLA + BFLA), defense-in-depth, GDPR/DSGVO grounding, backstop greps.
+Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
+
 ## See also
 
-- [`authz-review`](../skills/authz-review/SKILL.md) — the 6-stage per-entrypoint chain, defense-in-depth, authz matrix, negative-test contract.
+- [`authz-review`](../skills/authz-review/SKILL.md) — the 6-stage per-entrypoint chain, defense-in-depth, authz matrix, negative-test contract, and the migrated depth above.
 - [`security-sensitive-stop`](security-sensitive-stop.md) — threat-model BEFORE editing an auth/tenant path (fires first).
 - [`active-remediation`](active-remediation.md) — the fix-now/ask/follow-up ladder + the live-exposure safety carve-out.
 - [`threat-modeling`](../skills/threat-modeling/SKILL.md), [`multi-tenancy`](../skills/multi-tenancy/SKILL.md), [`ai-code-blindspots`](../skills/ai-code-blindspots/SKILL.md), [`privacy-review`](../skills/privacy-review/SKILL.md).

package/dist/agent-src/rules/code-comment-discipline.md

@@ -0,0 +1,148 @@
+---
+type: "auto"
+tier: "2b"
+alwaysApply: false
+description: "Writing/editing code in any language — a comment states a WHY or a constraint the code cannot show; never restate what names/types already say; no signature-mirroring docblocks"
+triggers:
+  - intent: "writing or generating code"
+  - intent: "adding a class / method / function"
+  - intent: "refactoring code"
+  - keyword: "comment"
+  - keyword: "docblock"
+  - keyword: "phpdoc"
+  - keyword: "jsdoc"
+  - keyword: "docstring"
+  - keyword: "implement"
+  - keyword: "class"
+  - keyword: "method"
+  - keyword: "refactor"
+workspaces: [engineering]
+packs: [engineering-base]
+---
+
+# Code Comment Discipline
+
+AI-written code over-comments: docblocks mirroring the signature, comments narrating the next line, banner headers, change-log notes. Every redundant comment costs tokens on every future read, bloats the file, rots into misinformation when code changes. Default for any new comment: **no** — a comment must earn its place.
+
+## The Iron Law
+
+```
+A COMMENT STATES A WHY OR A CONSTRAINT THE CODE CANNOT SHOW — NOTHING ELSE.
+NEVER RESTATE WHAT THE CODE, THE NAME, OR THE TYPE ALREADY SAYS.
+NO DOCBLOCK THAT ONLY MIRRORS THE NATIVE SIGNATURE.
+DOCBLOCKS EARN THEIR PLACE ONLY WITH MACHINE-RELEVANT PRECISION
+(GENERICS, ARRAY SHAPES, NON-TRIVIAL UNIONS) OR GENUINE WHY-CONTEXT.
+WHEN IN DOUBT: NO COMMENT. SHORTER IS BETTER. NONE IS OFTEN BEST.
+```
+
+## What a comment is FOR
+
+Exactly five legitimate jobs — everything else is noise:
+
+1. **A why** — non-obvious reason this approach beat the obvious one.
+2. **An invariant or constraint** code can't express — ordering, units, concurrency assumptions, "must run before X".
+3. **A warning** — known trap, workaround for a specific upstream bug (name it), performance cliff.
+4. **Machine-relevant type precision** the native type system can't carry — see carve-out below.
+5. **A spec linkage** where an external contract defines behavior (RFC section, protocol field) — the contract, not ticket history.
+
+Test before writing any comment: *would deleting it leave a future reader confused about a non-obvious constraint?* No → don't write it.
+
+## Banned comment classes
+
+| Banned | Example | Instead |
+|---|---|---|
+| What-narration | `// increment the counter` above `counter++` | Nothing — code says it |
+| Signature-mirroring docblock | `@param string $name The name` on `string $name` | Nothing — typehint says it |
+| Redundant `@return` | `@return bool` on `): bool` | Nothing |
+| Banner / section divider | `// ---------- Helpers ----------` | Structure the file; extract a class |
+| Change-log comment | `// added for the export feature`, `// per ticket #123` | Commit message / PR description |
+| Reviewer-directed justification | `// this is safe because my change …` | PR description |
+| Redundant property docblock | `/** @var LoggerInterface */` on a typed property | Nothing — property type says it |
+| Type-restating JSDoc in typed TS | `/** @param {string} id */` on `id: string` | Nothing — TS carries the type |
+| Obvious docstring | `"""Return the user."""` on `get_user()` | Nothing, or a real contract note |
+| Commented-out code | dead code kept "for reference" | Delete — git history is the tombstone |
+
+## Carve-out — machine-relevant precision docblocks STAY
+
+Docblock carrying type info the native type system can't express is **not** redundant — static analyzers + IDEs consume it. Keep (and write):
+
+- PHP generics / array shapes for PHPStan/Psalm: `@return Collection<int, Post>`, `@param array<string, User> $usersByEmail`, `@template T`, `@phpstan-type`.
+- Union/shape refinements the language can't express natively.
+- Tool-consumed markers: `@deprecated` (with successor), `@internal`, `@throws` for checked flows callers must handle.
+- Python typing only a docstring/stub can carry in the project's toolchain.
+
+The line: docblock must add information **beyond** the native signature. `@param array<int, Order> $orders` earns its place; `@param array $orders` does not.
+
+## Public-API carve-out — `code_style.docblocks`
+
+Read `code_style.docblocks` from `.agent-settings.yml` (missing → `minimal`):
+
+- `minimal` (default) — full discipline above; exported/public symbols get no summary docblock unless one of the five legitimate jobs applies.
+- `full` — **exported public surface of a library package** (published API consumers see in their IDE) MAY carry one-line summary docblock per symbol. Redundancy ban holds in `full`: no `@param`/`@return` lines mirroring the signature, ever.
+
+## Worked examples
+
+```php
+// ❌ Redundant — every line restates the signature
+/**
+ * Get the user by id.
+ *
+ * @param int $id The user id.
+ * @return User|null The user or null.
+ */
+public function getUserById(int $id): ?User
+
+// ✅ Nothing to add — the signature is the documentation
+public function getUserById(int $id): ?User
+```
+
+```php
+// ✅ Docblock KEPT — the generic is machine-relevant (PHPStan), the native type can't carry it
+/** @return Collection<int, Post> */
+public function publishedPosts(): Collection
+```
+
+```ts
+// ❌ Redundant — TS already knows all of this
+/**
+ * Formats the price.
+ * @param amount - the amount
+ * @returns the formatted price
+ */
+export function formatPrice(amount: number): string
+
+// ✅ A real constraint the signature can't show
+// Rounds half-up to match the invoice PDF renderer; Intl default is half-even.
+export function formatPrice(amount: number): string
+```
+
+```python
+# ❌ Narration
+# loop over the items and sum the totals
+total = sum(item.total for item in items)
+
+# ✅ A why that survives
+# Stripe amounts are integer cents; convert once at the boundary, never downstream.
+total_cents = sum(item.total_cents for item in items)
+```
+
+## Scope boundary
+
+Governs **new and edited code only**. Never a license to strip comments from untouched code — [`minimal-safe-diff`](minimal-safe-diff.md) wins on diff shape ("no docstrings/comments on untouched code" cuts both ways: don't add, don't remove). Sweeping a file's existing comments = separate, explicitly-requested cleanup task.
+
+## When NOT to fire
+
+- Prose surfaces: docs, READMEs, roadmaps, config commentary — different register, not code comments.
+- User explicitly asks for documented code / teaching examples ("erkläre im Code", "annotate this for juniors") — that turn's ask wins.
+- License headers or file-level pragmas a toolchain requires.
+
+## Fixtures
+
+Behavioral baseline: `tests/code-comments/eval-fixtures.md` (`ccd-php-class-generation`, `ccd-ts-module-generation`, `ccd-untouched-preservation`, `ccd-explicit-teaching-override`); decidable criteria proven by `tests/scripts/code_comment_fixtures.test.ts`.
+
+## See also
+
+- [`code-clarity.md § Comment discipline`](../docs/guidelines/code-clarity.md#comment-discipline--state-a-constraint-not-a-narration) — canonical long-form with per-language keep/drop tables.
+- [`minimal-safe-diff`](minimal-safe-diff.md) — diff-shape twin; no comment additions or removals on untouched code.
+- [`output-discipline`](output-discipline.md) — adjacent but distinct: bans placeholder prose (`// TODO: implement`); this rule bans redundant prose.
+- `docs/guidelines/php/php-coding-patterns.md` § PHPDoc — PHP-specific operationalization.

package/dist/agent-src/rules/context-hygiene.md

@@ -67,6 +67,20 @@ When **3 consecutive attempts** at the same task fail (code fix, test fix, confi
 
 **Does NOT reset the counter:** Unrelated tasks. User providing new information (course correction).
 
+**Failure identity — same error vs new error.** Failure signature = **same target + same error class** (same failing test + same assertion/exception, same lint rule id, same build error).
+
+- **Same failure signature twice → stop and pivot now.** Don't burn the third attempt on a near-identical retry of a fix that already failed the same way — a repeated identical signature means the hypothesis is wrong, not under-applied. Change strategy (re-read source, new hypothesis, ask).
+- **New error signature each attempt = progress.** Peeling one error to reveal a different one is forward motion; counter continues — learning, not looping.
+
+**Hard-blocker classes — skip retries, go straight to ask/surface.** On the **first** occurrence, do not count toward the 3 — stop and surface:
+
+- Missing credentials / unset required secret or token.
+- Permission denied (auth/authz, file mode, protected branch, scope).
+- Spend / quota / rate limit reached (billing cap, API quota, 429 that won't self-clear).
+- External-service `5xx` / outage / DNS-unreachable — a dependency is down, not your code.
+
+Retrying a hard-blocker is the canonical wasted-attempt; the fix is a decision or external change only the user/environment can make.
+
 ## Tool Loop Detection
 
 Calling the **same tool** more than **2 times in a row** with similar parameters = loop.

package/dist/agent-src/rules/delegation-policy.md

@@ -61,22 +61,24 @@ primitive → run in-session (clean no-op).
 2. **Tier-size** each slice (`lite|medium|high`) per the classification context —
    never the orchestrator's own session tier (the cost win is the per-call
    downsize; see [`subagent-routing`](../contexts/execution/subagent-routing.md)).
-3. **Dispatch** via the matching `subagent-orchestration` mode (independent →
-   do-in-parallel; ordered → do-in-steps; risk/correctness → + judge).
+3. **Dispatch** via the form gate + matching `subagent-orchestration` mode
+   (independent → do-in-parallel; ordered → do-in-steps; risk/correctness →
+   + judge; UI-heavy → live-app judge, efficacy-gated).
 4. **Verify** every return per
    [`verify-budget`](../contexts/execution/verify-budget.md); the cross-model
    judge Iron Law and the N=3 budget ([`autonomous-execution`](autonomous-execution.md))
    are never lifted.
 5. **Respect the failure-type stop and the ordering gate** — two consecutive
    verification-failed returns from one subagent type stop that type for the
-   session (an application of the N=3 budget, no new mechanism); an ordered
-   slice never dispatches before its declared parent's return is verified.
-   Both per [`subagent-steering`](../contexts/execution/subagent-steering.md).
+   session (an application of the N=3 budget, no new mechanism), and an
+   ordered slice never dispatches before its declared parent's return is
+   verified. Both per
+   [`subagent-steering`](../contexts/execution/subagent-steering.md).
 6. **Record** telemetry after each dispatch — run `orchestration_record`
    (one validated line: spawn_count, token_delta + provenance, tier, task_class)
    per [`orchestration-telemetry`](../contexts/execution/orchestration-telemetry.md)
-   § Emit. Agent-behavioral capture the savings report reads; skipping it leaves
-   the value-of-orchestration question unmeasured.
+   § Emit. This is the agent-behavioral capture the savings report reads;
+   skipping it leaves the value-of-orchestration question unmeasured.
 
 ## Scope — does NOT
 
@@ -88,7 +90,7 @@ primitive → run in-session (clean no-op).
 
 ## See also
 
-- [`subagent-orchestration`](../skills/subagent-orchestration/SKILL.md) — the 7 modes this selects.
+- [`subagent-orchestration`](../skills/subagent-orchestration/SKILL.md) — the form gate + 8 modes this selects.
 - [`subagent-boundary`](../docs/contracts/subagent-boundary.md) — what a subagent owns vs never owns (task-meaning, memory, pack-surface, safety-floor bypass).
 - [`auto-orchestration-activation`](../contexts/execution/auto-orchestration-activation.md) — the gate.
 - [`reasoning-orchestrator`](../skills/reasoning-orchestrator/SKILL.md) — RDP dispatch, now gated here.

package/dist/agent-src/rules/design-fidelity.md

@@ -88,6 +88,50 @@ redesign.
 - Treating an internal "honesty gate" or "stub" concern as licence to redesign the UI.
 - Re-running a redesign after the user already said "match the prototype".
 
+## Surgical visual edits
+
+A request to change one visual thing — a colour, a label, a single element — is
+a **targeted edit**, not a redesign licence. Apply the same
+[`minimal-safe-diff`](minimal-safe-diff.md) discipline to design work that
+backend edits have always owed.
+
+- **Change only the semantic target.** Preserve the surrounding layout,
+  spacing, typography, dimensions, content, animation, and interaction states.
+  Do not rewrite the component, reflow the section, or "modernise" neighbours
+  while you are in there. (fixtures: `daf-edit-preservation`, `daf-unwanted-variations`.)
+- **A broader redesign needs an explicit trigger.** Only phrases like *"new
+  direction"*, *"from scratch"*, *"make it feel premium"*, *"rework the flow"*,
+  or *"give me variations / options"* license a from-scratch rework. Absent such
+  a phrase, a "fix / change / update the X" request is surgical — when unsure
+  which, ask ([`ask-when-uncertain`](ask-when-uncertain.md)). (fixture: `daf-redesign-trigger`.)
+- **Preserve stable anchors.** Where the host exposes DOM/comment metadata, keep
+  comment anchors and screen labels intact so the edit stays locatable. Where
+  the host has no such surface, preserve stable semantic anchors already present
+  in source comments / `data-*` attributes — never strip them, and do not invent
+  new ones.
+
+## Asset & imagery discipline
+
+Visual artifacts carry **real assets or honest placeholders — never fabricated
+brand evidence**. The design-surface instance of the no-invented-facts floor.
+
+- **Copy owned assets through the project's accepted path.** Reference or copy
+  project-owned assets (logos, icons, fonts, images) via the target project's
+  asset directory/pipeline — never hotlink a design-system's internal URL, never
+  bulk-copy a huge source folder. (fixtures: `daf-missing-asset`, `daf-external-asset-url`.)
+- **Real imagery where inspection matters.** On visual pages/decks, use actual
+  product / place / object / state imagery where the image IS the proof (a
+  product screenshot, a real dashboard state). Decorative atmosphere is not proof
+  — never pass a stock-like or invented image off as the real product. An
+  invented product screenshot is fabricated evidence. (fixture: `daf-invented-screenshot`.)
+- **Icons follow the iconography floor** — no emoji-as-icon in serious UI, no
+  hand-rolled icon when a set exists; see
+  [`iconography`](../skills/iconography/SKILL.md) § Iconography floor.
+- **Ask before adding material — no unrequested filler.** Never generate copy,
+  placeholder sections, or decorative blocks the user did not ask for to "complete"
+  a design. Brief silent on a region → surface the gap ([`ask-when-uncertain`](ask-when-uncertain.md))
+  or leave an honest placeholder; never invent filler to fill space.
+
 ## See also
 
 - [`brand-source-of-truth`](brand-source-of-truth.md) / [`brand-consistency`](brand-consistency.md) — same precedence shape, for registered brand tokens.

package/dist/agent-src/rules/git-history-discipline.md

@@ -32,6 +32,8 @@ packs: [engineering-base]
 
 # Git History Discipline
 
+Fires on any rebase / squash / fixup / amend / force-push / `reset --hard` / squash-merge intent, on a divergent local↔origin state, or on a branch carrying commits you did not author this session.
+
 ## Iron Law — Gate (no unsolicited rewrites)
 
 ```
@@ -62,31 +64,6 @@ THAT ALREADY EXISTS ON A BRANCH (LOCAL OR REMOTE) — WITHOUT ASKING
 THE USER THIS TURN. PARALLEL WORK IS THE DEFAULT, NOT THE EXCEPTION.
 ```
 
-The user often works in parallel with the agent, and multiple agents may
-share one PR branch. A commit that looks "unrelated" or "stray" may be
-deliberate in-flight work the user expects to keep. Reseating a branch onto a
-different base, `git reset --hard`-ing away inherited commits, force-pushing
-over a branch you did not create, or branching from a base with unexpected
-commits and then "cleaning" them out all **silently discard work** — the exact
-failure this law prevents.
-
-Before ANY of these, STOP and ask (one numbered-options prompt per
-[`user-interaction`](user-interaction.md)):
-
-- reseating a branch's base (`git rebase --onto`, `git reset --hard <other-base>`)
-  in a way that drops commits already on the branch;
-- excluding / not-carrying-forward commits that were on the branch when you
-  started this session;
-- force-pushing (or `push <local>:<remote>`-replacing) a branch that carries
-  commits you did not author;
-- branching from a base with unexpected commits, then resetting them away.
-
-**Preserve-first is necessary but not sufficient.** Even when you keep the
-commits reachable (a save-branch / tag), you still **ask before** the branch
-the user sees loses them — "I preserved them locally" is not a substitute for
-the question, because the user may be mid-edit on the shared branch and a
-force-push would clobber their in-flight work regardless of your local backup.
-
 When in doubt about whether a commit is yours to touch: it is not. Ask.
 
 ## When rewrite is allowed
@@ -99,60 +76,8 @@ Exactly three:
 
 Anything else — chunk-tidiness, "logical order", folding a follow-up fix into its parent — **forbidden**. The follow-up ships as its own commit (`fix: …`, `chore: …`).
 
-## Two protective stops (for the protocol phase)
-
-1. **Pre-rewrite stop.** Before any squash / amend / rebase on a branch that is on origin: `git fetch && git rev-list --left-right --count HEAD...@{u}`. If **either** side is non-zero — STOP and route to `skill:git-workflow § Divergent-State Recovery`. A blind `git pull --rebase` in this state is the documented failure mode.
-
-2. **Post-rewrite stop.** After the rewrite, push in the **same turn** with `--force-with-lease=<branch>:<fetched-sha>` and verify `git rev-parse origin/<branch>` equals `git rev-parse HEAD`. If the push fails (hook, network, token budget) — fix the cause and re-push **before** ending the session, committing new work, or handing off.
-
-If either stop fires and resolution is not immediate → tag the state (`git tag local-rewritten-tip-<ISO-date>`) and hand control back to the user. Do not let a new session inherit a dirty divergence.
-
-## Equivalents that are also forbidden by default
-
-- `git rebase -i` (interactive)
-- `git rebase --autosquash`
-- `git commit --fixup` / `--squash` (helpers that feed autosquash)
-- `git commit --amend` on already-pushed commits
-- `git push --force` / `--force-with-lease` (unless paired with the protocol)
-- `git reset --hard` past unpushed work the user might want
-- Squash-merge of a PR via API or CLI when the user has not picked the merge strategy
-- Cherry-pick rewriting that drops or reorders commits
-
-`--amend` on the *current local* commit before the first push is the narrow exception (treated as continuing to compose the commit, not rewriting history).
-
-## Amend-after-hook-failure trap (data-loss)
-
-When a **pre-commit hook fails, the commit did NOT happen** — no new commit
-object was created. A reflexive `git commit --amend` at that point does not
-"retry the commit"; it rewrites the **previous, already-good** commit,
-destroying that work. This is the one place the narrow `--amend` exception
-above turns into data loss.
-
-Recovery — never amend after a hook failure:
-
-1. Read the hook output and **fix the cause** (the lint/test/format failure).
-2. **Re-stage** the fix (`git add`).
-3. Create a **NEW commit** (`git commit`, not `--amend`) — the prior commit was
-   never overwritten and must stay intact.
-
-Recovery procedures live next to this mechanism in
-[`skill:git-workflow`](../skills/git-workflow/SKILL.md).
-
-## Why this rule exists
-
-Interactive rebase + fixup loops generate disproportionate token cost on every iteration: re-running CI per replayed commit, resolving the same content conflict in three derived files (`.condensation-hashes.json`, `dist/router.json`, `.windsurfrules`), losing the working tree to a stash that silently re-introduces older state. A single conflict can burn the budget of an entire feature.
-
-A previous session squashed a pushed branch, the push hook failed at the token boundary, the session ended — and the next session saw local and origin pointing at different SHAs for the same logical work. A blind `git pull --rebase` cascaded into conflicts across every derived file. Recovery required forensic SHA-archaeology. The pre/post-rewrite stops make that sequence structurally impossible.
-
-## When you'd be tempted
-
-- "I want commit 3 to come before commit 2 because the topic flows better." → don't. Reviewers read the PR diff.
-- "There are two `chore: regenerate` commits, ugly." → don't. They are honest checkpoints.
-- "A linter caught an issue in commit 2 — let me fold the fix in." → don't. Add `fix(scope): …` on top.
-- "I want to drop the WIP commit before pushing." → ask the user first.
-- "Squash-merge when I open the PR will clean it anyway." → also true, also irrelevant — let the merge strategy do that work, not you.
-- "My branch inherited some unrelated commits — I'll reseat it on `origin/main` so my PR is clean." → **don't, ask first.** They may be the user's parallel work or another agent's. Preserve them and ask which base the user wants.
-- "The remote branch has commits I didn't author and no PR — I'll just force-push over it." → don't. No-PR is not no-owner; ask before replacing a branch you did not create.
+Body migrated to `skill:git-workflow` (per P4 of `road-to-kernel-and-router.md`) — shared-branch ask-before-drop protocol, two protective stops, forbidden-equivalents list, amend-after-hook-failure recovery, why-this-exists rationale, temptation catalog.
+Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 ## See also