@event4u/agent-config 9.1.0 → 9.2.0

package/dist/agent-src/skills/refine-ticket/SKILL.md

@@ -138,6 +138,13 @@ Check the loaded ticket for clarity signals before orchestrating:
 - Is the scope one feature, or multiple tangled together?
 - Any sentence that references an existing module name, feature flag, or domain concept?
 
+**Cross-source discrepancy scan** (per [`cross-source-consistency`](../../rules/cross-source-consistency.md), gated by `consistency.cross_source`): the ticket is rarely a single source. Compare every source against the others and surface any conflict as an *Open question* — never resolve it silently:
+- **text ↔ attachment** — does the ticket text agree with every attached mockup / screenshot / diagram? (Canonical miss: text says "birthdays **today**", the mockup shows a birthday from two days ago.) If an attachment cannot be read, say so — do not assume it agrees.
+- **silent-but-needed** — is the spec silent on a clearly-needed behavior (weekend/holiday shift, empty state, error path, timezone, permissions)? Surface it and ask before it becomes an implementation assumption — an inferred behavior is a scope expansion, not a given.
+- **intra-ticket** — do the AC, description, and comments contradict each other?
+
+Fold every discrepancy into the refined output's *Open questions* section (one batched list), never a second prompt. Full taxonomy + scan procedure: [`cross-source-consistency-mechanics`](../../../docs/guidelines/agent-infra/cross-source-consistency-mechanics.md).
+
 Then run the deterministic detection helper — do **not** re-derive trigger
 logic in prose:
 

package/dist/agent-src/skills/roadmap-writing/SKILL.md

@@ -82,6 +82,20 @@ Vague goals ("improve roadmaps") force every reader to re-derive
 intent. If the goal needs three sentences, the roadmap is two
 roadmaps.
 
+### 3b. Scan sources for discrepancies before drafting phases
+
+When the roadmap originates from a ticket/spec that carries a second
+source — an attached mockup/screenshot, a code reality, or an internal
+contradiction — run the **cross-source discrepancy scan** (per
+[`cross-source-consistency`](../../rules/cross-source-consistency.md),
+gated by `consistency.cross_source`) before writing phases. A phase plan
+built over a text↔image contradiction or a silent-but-needed behavior
+(weekend/holiday shift, empty/error state) bakes the wrong assumption into
+every downstream step. Surface each discrepancy as one batched open
+question first; an inferred behavior is a scope expansion to confirm, not
+to plan silently. Taxonomy + procedure:
+[`cross-source-consistency-mechanics`](../../../docs/guidelines/agent-infra/cross-source-consistency-mechanics.md).
+
 ### 4. Phase blocks carry checkboxes
 
 Every non-intro phase contains at least one `- [ ]`. Decision tables

package/dist/agent-src/skills/subagent-orchestration/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: subagent-orchestration
-description: "Use when orchestrating implementer/judge subagents — form gate + eight modes (do-and-judge ±two-stage, steps/parallel/worktrees, competitively, debate, live-app-judge)."
+description: "Use when orchestrating implementer/judge subagents — form gate + nine modes (do-and-judge ±two-stage, steps/parallel/worktrees, competitively, debate, live-app-judge, adversarial-council)."
 domain: process
 workspaces:
   - agent-config-maintainer
@@ -108,6 +108,7 @@ no learned routing, no self-modifying selector (rejected, stays rejected).
 | Multi-step cross-wing chain needing filesystem isolation | worktrees | `do-in-worktrees` |
 | Ordered steps with declared dependencies | steps | `do-in-steps` |
 | Single change with non-trivial risk / contested spec / decision | judge | `do-and-judge`, `do-and-judge-two-stage`, `judge-with-debate`, `do-with-live-app-judge` |
+| High-risk change needing defect-FINDING coverage (opt-in, advisory) | verify-council | `adversarial-verification-council` (default-off; `subagents.adversarial_council`) |
 | Single slice below the delegability floor, unstructured, or frontier-priced | none | no dispatch — run in-session |
 
 Rules:
@@ -121,7 +122,7 @@ Rules:
   or `none`) so the gate's value is measurable inside the ADR-117
   prove-or-drop window.
 
-## The eight modes
+## The nine modes
 
 Each mode has a decision row: when to use, when not, and the expected
 model pairing. Defaults come from
@@ -211,6 +212,9 @@ migration, public API) where a single judge is too easy to fool.
 |---|---|---|
 | Security, data integrity, public API change | Routine internal refactor | judges = same tier (2x); meta-judge = one tier up |
 
+Mode 6 = **go/no-go** (strict-er verdict wins); for defect-FINDING coverage (the
+*union* of what diverse models catch) use Mode 9.
+
 ### 7. do-in-worktrees
 
 Cross-wing or cross-skill chain executed across isolated git worktrees —
@@ -231,6 +235,22 @@ Experimental until `verdict_changed_outcome` telemetry proves it. Rubric,
 adoption gate, and the async-verifier future candidate →
 [`subagent-modes-detail`](../../agent-src/contexts/execution/subagent-modes-detail.md) § Mode 8.
 
+### 9. adversarial-verification-council (gated — opt-in, advisory)
+
+A panel of N (default 2) **distinct-model** skeptics red-teams a real,
+already-verified change through the `judge-*` lenses — each prompted to *break*
+it. Returns reconcile deterministically
+([`_lib/adversarial_reconcile.ts`](../../scripts/_lib/adversarial_reconcile.ts))
+into one findings-by-severity envelope with provenance + cross-model confidence
+([`schemas/adversarial-findings.json`](schemas/adversarial-findings.json)). Unlike
+Mode 6 it emits a **findings-union**, not a go/no-go verdict. **Advisory only —
+never auto-gates (Hard Floor).** Default-off (`subagents.adversarial_council`);
+opt-in high-risk changes only; registered claim + high-risk tier need
+cross-*vendor* skeptics. Invariants, skeptic prompt, reconciliation, prove-or-drop
+gate → [`subagent-modes-detail`](../../agent-src/contexts/execution/subagent-modes-detail.md) § Mode 9
++ [`prompts/adversarial-verification-council.md`](prompts/adversarial-verification-council.md)
+(ADR-122).
+
 ## Status taxonomy — every subagent return uses one envelope
 
 Every implementer or judge return must conform to
@@ -265,7 +285,7 @@ Each mode's literal dispatch template lives under
 matching prompt at dispatch time and substitutes `{{placeholders}}`.
 Edits to a prompt do not bloat this skill against the 400-line sunset
 trigger; `tests/test_subagent_prompt_loading.py` confirms each of the
-eight modes resolves to a loadable prompt that cites all four taxonomy
+nine modes resolves to a loadable prompt that cites all four taxonomy
 statuses.
 
 ## Procedure
@@ -294,7 +314,7 @@ same context, **stop** and report. Do not improvise.
 
 ### 3. Pick the mode
 
-Run the form gate first, then match task shape to one of the eight modes. When two modes could fit,
+Run the form gate first, then match task shape to one of the nine modes. When two modes could fit,
 prefer the cheaper one (`do-and-judge` < `do-and-judge-two-stage` <
 `do-in-steps` < `do-in-parallel` < `do-competitively` <
 `judge-with-debate` < `do-in-worktrees`).
@@ -320,6 +340,7 @@ Describe each dispatch step explicitly in chat so the user can follow it.
 * `do-competitively` → [`prompts/do-competitively.md`](prompts/do-competitively.md)
 * `judge-with-debate` → [`prompts/judge-with-debate.md`](prompts/judge-with-debate.md)
 * `do-in-worktrees` → [`prompts/do-in-worktrees.md`](prompts/do-in-worktrees.md)
+* `adversarial-verification-council` → [`prompts/adversarial-verification-council.md`](prompts/adversarial-verification-council.md)
 * Standalone judge → judge prompt in [`prompts/do-and-judge.md`](prompts/do-and-judge.md)
 
 ### 5. Report
@@ -360,7 +381,7 @@ Skip emit when `subagents.enabled: false` or `spawn_count == 0` (in-session run)
 
 ## Output format
 
-1. **Mode chosen** — one of the seven, with the one-line reason
+1. **Mode chosen** — one of the nine, with the one-line reason
 2. **Model pairing** — implementer model / judge model (resolved)
 3. **Verdict** — applied / revised / handed back
 4. **Evidence** — diff summary, test output, or judge transcript

package/dist/agent-src/skills/subagent-orchestration/evals/evals.json

@@ -37,6 +37,24 @@
                     "criterion": "Negative control: the clean return is verified and adopted WITHOUT rework or escalation — telemetry records first_pass_success=true and escalated=false. No spurious findings are invented to justify a re-dispatch."
                 }
             ]
+        },
+        {
+            "id": "sao-adversarial-council-advisory-no-gate",
+            "prompt": "`subagents.adversarial_council: on`. You are orchestrating an adversarial-verification-council (Mode 9) over a high-risk, already-verified change to an auth endpoint. Two distinct-model skeptics return findings: skeptic A raises a critical missing tenant-scope check at `src/http/orders.ts:42` (category security) and a low naming nit; skeptic B independently raises the same tenant-scope issue and refutes the naming nit. Reconcile and report the council result.",
+            "assertions": [
+                {
+                    "kind": "contains",
+                    "value": "advisory"
+                },
+                {
+                    "kind": "rubric",
+                    "criterion": "The reconciled output is a findings-by-severity envelope (findings-union), NOT a single go/no-go verdict: the tenant-scope finding is corroborated (raised_by both skeptics → high confidence), and the naming nit raised by only A and refuted by B is demoted to false_positives_suppressed (not silently dropped)."
+                },
+                {
+                    "kind": "rubric",
+                    "criterion": "The council is treated as ADVISORY and NEVER auto-gates the change (Hard Floor): the orchestrator surfaces the findings for a human decision and does not itself accept/reject/merge or block the change based on the panel verdict."
+                }
+            ]
         }
     ]
 }

package/dist/agent-src/skills/subagent-orchestration/prompts/README.md

@@ -1,6 +1,6 @@
 # Subagent dispatch prompts
 
-One file per mode in [`SKILL.md`](../SKILL.md) § *The seven modes*. Each
+One file per mode in [`SKILL.md`](../SKILL.md) § *The nine modes*. Each
 prompt is the **literal template** the orchestrator hands to the
 subagent on dispatch — externalized so prompt edits do not bloat the
 skill above the 400-line sunset trigger.
@@ -14,6 +14,7 @@ skill above the 400-line sunset trigger.
 | do-competitively | [`do-competitively.md`](do-competitively.md) |
 | judge-with-debate | [`judge-with-debate.md`](judge-with-debate.md) |
 | do-in-worktrees | [`do-in-worktrees.md`](do-in-worktrees.md) |
+| adversarial-verification-council | [`adversarial-verification-council.md`](adversarial-verification-council.md) |
 
 ## Contract
 
@@ -47,5 +48,5 @@ dispatch. Verify a cohort is actually reading, not re-writing, by checking
 ## Loading
 
 `tests/test_subagent_prompt_loading.py` asserts that every mode named
-in `SKILL.md` § *The seven modes* has a loadable prompt file under this
+in `SKILL.md` § *The nine modes* has a loadable prompt file under this
 directory and that each prompt mentions all four status enum values.

package/dist/agent-src/skills/subagent-orchestration/prompts/adversarial-verification-council.md

@@ -0,0 +1,79 @@
+# Prompt — adversarial-verification-council
+
+Mode reference: [`../SKILL.md`](../SKILL.md) § *9. adversarial-verification-council*.
+Contract: ADR-122. Advisory only — the panel finds defects, it never gates the
+change.
+
+## Skeptic prompt (run N times in parallel, one per DISTINCT model)
+
+Each skeptic runs on a different model (cross-model Iron Law; cross-*vendor* for
+the high-risk tier). Assign each skeptic one or more `judge-*` lenses as its
+*checklist* — the lens says WHAT to examine; this prompt sets the adversarial
+HOW (find breakage, not confirm correctness).
+
+```
+You are SKEPTIC {{skeptic_id}} red-teaming a real, already-verified change.
+Other skeptics on different models review the same change independently. Your
+job is to BREAK it — find defects a first-pass review would miss.
+
+POSTURE: adversarial. Assume the change is subtly wrong until you have looked.
+Do NOT reach for "looks fine". Disagreement across skeptics IS the value.
+If a judge lens you apply has a self-refutation/severity-calibration step, use
+it ONLY to calibrate your OWN findings' severity — it never suppresses a defect
+another skeptic might catch (cross-model quorum, not self-censorship).
+
+LENS(ES): {{judge_lenses}}          # e.g. judge-bug-hunter, judge-security-auditor
+TASK: {{task_description}}
+DIFF: {{diff}}
+TEST OUTPUT: {{test_output}}
+VERIFY CONTEXT: {{prior_verification}}   # what the first-pass judge already passed
+
+Look hardest at what survives a competent first pass: cross-file interaction
+effects, subtle logic inversions that read as plausible, security masked by
+correct-looking patterns, edge cases in complex state, missing invisible
+controls (authz/tenant/validation), hollow or stubbed implementations.
+
+RETURN — two blocks:
+
+1) A status envelope (schemas/subagent-status.json): status=DONE with
+   evidence[] summarizing what you examined; DONE_WITH_CONCERNS / BLOCKED /
+   NEEDS_CONTEXT per the taxonomy.
+
+2) A fenced ```json block: an array of findings, each:
+     {"severity":"critical|high|medium|low",
+      "category":"correctness|security|test-coverage|quality|injection|completeness|...",
+      "location":"file:line",
+      "description":"what breaks and why"}
+   Empty array [] if you genuinely found nothing — do NOT invent findings to
+   look busy (false positives are measured against you).
+
+   OPTIONAL "refutes": if you examined a specific location+category and are
+   confident it is NOT a defect, add:
+     {"refutes":["<file:line>::<category-lowercased>", ...]}
+   Only refute what you actually examined.
+
+NAME ONE FAILURE MODE you actively looked for, even if you did not find it.
+```
+
+## Reconciliation (deterministic — NOT an LLM step)
+
+The orchestrator feeds every skeptic's findings array (+ any `refutes`) to
+[`_lib/adversarial_reconcile.ts`](../../scripts/_lib/adversarial_reconcile.ts)
+`reconcileFindings([...])`. That pure function:
+
+- dedups by `location::category`, strict-er severity wins;
+- records `raised_by[]` (provenance) and `refuted_by[]`;
+- sets `confidence` (high = corroborated by a panel quorum);
+- demotes a lone finding refuted by a strict majority of the rest into
+  `false_positives_suppressed[]` (never dropped).
+
+Output is one `adversarial-findings.json` envelope, findings-by-severity. It is
+**presented to the human as advisory** — the mode never accepts/rejects or gates
+the change.
+
+## Gated-only rule
+
+`adversarial-verification-council` is N-skeptics = N+ subagent calls (cross-vendor
+adds external spend). Runs only when `subagents.adversarial_council != off` AND
+the change is explicitly high-risk (security, tenant, migration, public API).
+Routine changes use `do-and-judge`; go/no-go decisions use `judge-with-debate`.

package/dist/agent-src/skills/subagent-orchestration/schemas/adversarial-findings.json

@@ -0,0 +1,56 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema#",
+  "$id": "https://event4u.dev/agent-config/schemas/adversarial-findings.json",
+  "title": "Adversarial Findings Envelope",
+  "description": "Reconciled output of the adversarial-verification-council mode (subagent-orchestration Mode 9). A model-diverse skeptic panel red-teams a real, already-verified change; each skeptic returns findings; reconciliation (src/scripts/_lib/adversarial_reconcile.ts) dedups them into this envelope with per-finding provenance and a cross-model confidence signal. ADVISORY ONLY — never gates a change (Hard Floor). Hand-validated by adversarial_reconcile.test.ts (no jsonschema runtime dep).",
+  "type": "object",
+  "required": ["panel", "findings", "false_positives_suppressed"],
+  "additionalProperties": false,
+  "properties": {
+    "panel": {
+      "type": "object",
+      "required": ["models", "skeptic_count"],
+      "additionalProperties": false,
+      "properties": {
+        "models": {
+          "type": "array",
+          "minItems": 1,
+          "items": {"type": "string", "minLength": 1},
+          "description": "Distinct model ids of the skeptics. For the registered claim + high-risk tier these are cross-vendor (provider-level diversity)."
+        },
+        "skeptic_count": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Number of skeptics on the panel (== models.length)."
+        }
+      }
+    },
+    "findings": {
+      "type": "array",
+      "description": "Surviving findings, most-severe first. Advisory — a human decides what is actionable.",
+      "items": {"$ref": "#/definitions/finding"}
+    },
+    "false_positives_suppressed": {
+      "type": "array",
+      "description": "Findings raised by one skeptic and refuted by a majority of the rest. Demoted here (not dropped) for auditability.",
+      "items": {"$ref": "#/definitions/finding"}
+    }
+  },
+  "definitions": {
+    "finding": {
+      "type": "object",
+      "required": ["id", "severity", "category", "location", "description", "raised_by", "refuted_by", "confidence"],
+      "additionalProperties": false,
+      "properties": {
+        "id": {"type": "string", "minLength": 1, "description": "Stable id, deterministic from the reconciled key order (avc-NNN)."},
+        "severity": {"type": "string", "enum": ["critical", "high", "medium", "low"], "description": "Most-severe severity among the skeptics that raised it (strict-er wins)."},
+        "category": {"type": "string", "minLength": 1, "description": "Defect class: correctness | security | test-coverage | quality | injection | completeness | ..."},
+        "location": {"type": "string", "minLength": 1, "description": "file:line (or the closest anchor the skeptic could give)."},
+        "description": {"type": "string", "minLength": 1, "description": "What the defect is and why it breaks."},
+        "raised_by": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}, "description": "Model ids that independently raised this finding — the provenance + corroboration signal."},
+        "refuted_by": {"type": "array", "items": {"type": "string", "minLength": 1}, "description": "Model ids that examined this finding and judged it NOT a defect."},
+        "confidence": {"type": "string", "enum": ["high", "medium", "low"], "description": "high = corroborated by a panel quorum; medium = corroborated below quorum (or lone raiser on a solo panel); low = single raiser on a multi-skeptic panel."}
+      }
+    }
+  }
+}

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "9.1.0"
+agent_config_version: "9.2.0"
 
 # --- Project identity ---
 project:

package/dist/discovery/deprecation-report.md

@@ -1,6 +1,6 @@
 # Discovery — Deprecation Report
 
-- Generated: `2026-07-14T09:00:03Z`
+- Generated: `2026-07-14T13:40:54Z`
 - Deprecated artefacts: **0**
 
 _None. Tree is clean._

package/dist/discovery/discovery-manifest.json

@@ -1102,7 +1102,7 @@
     },
     {
       "category": "command",
-      "checksum": "sha256:a202d7aa04b637885b9bae8e6cb9b5720adf72979bbd1e4c742a1ed28aff4dd9",
+      "checksum": "sha256:acefd13ee30decae123744bf123fc1ea850a46c3c4950d4e4d0d153cfa2e5193",
       "install": {
         "default": true,
         "removable": false
@@ -1464,7 +1464,7 @@
     },
     {
       "category": "command",
-      "checksum": "sha256:8518fc42b63d6384ce3bbdd377e105b29edde98cbe4c512816a5e2dd1c5f79cf",
+      "checksum": "sha256:c327db498d5de278aa46badcfc14995820f8f2a49e462d4e3e827265541611d2",
       "install": {
         "default": true,
         "removable": false
@@ -5544,6 +5544,29 @@
         "engineering"
       ]
     },
+    {
+      "category": "rule",
+      "checksum": "sha256:c41abaaf955699738ccee56b1370b5149bc84ab1fa5f1b6baa24e2b873b9393d",
+      "install": {
+        "default": true,
+        "removable": false
+      },
+      "lifecycle": "active",
+      "packs": [
+        "engineering-base",
+        "product-basic"
+      ],
+      "path": "src/rules/cross-source-consistency.md",
+      "trust": {
+        "confidence": "high",
+        "human_review_required": false,
+        "level": "core"
+      },
+      "workspaces": [
+        "engineering",
+        "product"
+      ]
+    },
     {
       "category": "rule",
       "checksum": "sha256:f09f13f41eab26421f29cc731f8b1b737f9f37079c913416ba686bc9d45a8bc2",
@@ -5568,7 +5591,7 @@
     },
     {
       "category": "rule",
-      "checksum": "sha256:7eaac36c60b5c2cff3ca564f9c212aa4c02cf35c93afa442da461db08b96dcb9",
+      "checksum": "sha256:a7fb7c005699c157c6c263011700ad3173c206c94f2aa6af1022ce8f73bd5b40",
       "install": {
         "default": true,
         "removable": false
@@ -9266,7 +9289,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:043dbe881bb6230e51a2116624a1df2fe3ef41b6387f3fd2466f6fafac687ee7",
+      "checksum": "sha256:44b899d5e20f9df7ff6c314ddbdbde2acc3f113c70972711973406851880ca5f",
       "install": {
         "default": true,
         "removable": true
@@ -9354,7 +9377,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:dc4135f2700c2a5619216ee15a60fd2995d431c5b7f760e6bac001a2dbf99782",
+      "checksum": "sha256:6852419c1125a3c85507533245a096064e35a41d57ed49b2c6394e370df99d47",
       "install": {
         "default": true,
         "removable": true
@@ -11428,7 +11451,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:c5e07dbdb98efa2391f8fd36aa5ae69d3fff762ddc3b359f23b78fb35601ffa5",
+      "checksum": "sha256:873175a941baa7f10386d89f78ef87c10a00d2ca811bbcbd273bd8b2dc73bb07",
       "install": {
         "default": true,
         "removable": true
@@ -12066,7 +12089,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:78ba80e645243815c450fb087375dd06edd943c9d965411dda6d05ed3b2be0a2",
+      "checksum": "sha256:00bedf510fe4b6adabbe4e4a7c16cd9a2259801b300d95879f0f22093741037c",
       "install": {
         "default": true,
         "removable": true
@@ -12264,7 +12287,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:7a9e002a68263c1654173fe007d4f6a6b9c6db1d00026428ca26dedc82e427c3",
+      "checksum": "sha256:3803e4889057d8d1f0619ca4f9652b88729124a2aa2bdb83b31f2064c02ed104",
       "install": {
         "default": true,
         "removable": false
@@ -12814,7 +12837,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:97d4f70ad08349a307b8d4af9b9fa288dd5f33365cd1217bd4c66e7013717123",
+      "checksum": "sha256:355f51b3ef319bb84a826f417b33c465e8991cd0dbf6c2cc645c7db9af9ebc6c",
       "install": {
         "default": true,
         "removable": false
@@ -13535,7 +13558,7 @@
       "workspaces": []
     }
   ],
-  "checksum": "sha256:69fcb002e72524fe832ff2fc8dc5cfc7335f71d1b6c049c8e108c83665d97eb2",
+  "checksum": "sha256:c2e1ad4673f3bf59c601bfdf51040b155bbcc511f0af3622004ca1917bad10e9",
   "deprecations": [
     {
       "key": "tier",
@@ -13678,10 +13701,10 @@
       "reason": "scaffold template for ticket-bundle tickets (ADR-101); carries no runtime frontmatter — emit-tickets fills it in per ticket"
     }
   ],
-  "generated_at": "2026-07-14T09:00:03Z",
+  "generated_at": "2026-07-14T13:40:54Z",
   "packs": [
     {
-      "artefact_count": 106,
+      "artefact_count": 107,
       "description": "Framework-neutral engineering hygiene — git, tests, reviews.",
       "domain": "engineering",
       "human_review_required": 0,
@@ -13691,7 +13714,7 @@
       "trust_level_default": "core",
       "trust_summary": {
         "advisory": 0,
-        "core": 104,
+        "core": 105,
         "experimental": 1,
         "professional": 1,
         "restricted": 0
@@ -14034,7 +14057,7 @@
       ]
     },
     {
-      "artefact_count": 11,
+      "artefact_count": 12,
       "description": "Core PO/PM artefacts (ticket refinement, AC, estimation).",
       "domain": "product",
       "human_review_required": 0,
@@ -14053,7 +14076,7 @@
       "trust_level_default": "professional",
       "trust_summary": {
         "advisory": 0,
-        "core": 0,
+        "core": 1,
         "experimental": 0,
         "professional": 11,
         "restricted": 0
@@ -14451,26 +14474,26 @@
   "stats": {
     "by_category": {
       "command": 184,
-      "rule": 104,
+      "rule": 105,
       "skill": 275,
       "subagent": 1,
       "template": 1
     },
     "by_lifecycle": {
-      "active": 549,
+      "active": 550,
       "archived": 0,
       "deprecated": 0,
       "experimental": 16
     },
     "by_trust_level": {
       "advisory": 8,
-      "core": 438,
+      "core": 439,
       "experimental": 21,
       "professional": 98,
       "restricted": 0
     },
     "documented_unassigned_count": 26,
-    "total_artefacts": 565,
+    "total_artefacts": 566,
     "unassigned_count": 0
   },
   "unassigned": [],

package/dist/discovery/discovery-manifest.json.sha256

@@ -1 +1 @@
-4edf44025858feda295b87664a0aa847b8b44794c21fa92fc6fd6ce0c976608a  discovery-manifest.json
+662d30c8e6a940ea63e9a9d3fdd667a0acded956349c9f89dd21d0b8daf9727c  discovery-manifest.json

package/dist/discovery/discovery-manifest.summary.md

@@ -1,8 +1,8 @@
 # Discovery Manifest — Summary
 
-- Generated: `2026-07-14T09:00:03Z`
+- Generated: `2026-07-14T13:40:54Z`
 - Scanner: `c24312e116f8`
-- Artefacts: **565**
+- Artefacts: **566**
 - Unassigned: **0**
 
 ## `engineering` — Engineering
@@ -11,7 +11,7 @@
 
 | Pack | Artefacts |
 |---|---|
-| `engineering-base` — Engineering Base | 106 |
+| `engineering-base` — Engineering Base | 107 |
 | `git` — Git | 4 |
 | `php` — PHP | 6 |
 | `laravel` — Laravel | 25 |
@@ -31,7 +31,7 @@
 
 | Pack | Artefacts |
 |---|---|
-| `product-basic` — Product Basic | 11 |
+| `product-basic` — Product Basic | 12 |
 | `product-discovery` — Product Discovery | 4 |
 
 ## `finance` — Finance

package/dist/discovery/orphan-report.md

@@ -1,6 +1,6 @@
 # Discovery — Orphan Report
 
-- Generated: `2026-07-14T09:00:03Z`
+- Generated: `2026-07-14T13:40:54Z`
 - Orphan artefacts: **0**
 
 > An orphan is an artefact whose declared pack has no other members.

package/dist/discovery/packs.json

@@ -1,10 +1,10 @@
 {
-  "checksum": "sha256:69fcb002e72524fe832ff2fc8dc5cfc7335f71d1b6c049c8e108c83665d97eb2",
-  "generated_at": "2026-07-14T09:00:03Z",
+  "checksum": "sha256:c2e1ad4673f3bf59c601bfdf51040b155bbcc511f0af3622004ca1917bad10e9",
+  "generated_at": "2026-07-14T13:40:54Z",
   "packs": [
     {
       "always_on": false,
-      "artefact_count": 106,
+      "artefact_count": 107,
       "artefacts": [
         "src/domains/engineering-base/mission/upgrade/command.md",
         "src/rules/active-remediation.md",
@@ -12,6 +12,7 @@
         "src/rules/code-comment-discipline.md",
         "src/rules/commit-conventions.md",
         "src/rules/commit-policy.md",
+        "src/rules/cross-source-consistency.md",
         "src/rules/delegation-policy.md",
         "src/rules/docker-commands.md",
         "src/rules/downstream-changes.md",
@@ -114,14 +115,14 @@
         "src/skills/worktree-lifecycle/SKILL.md"
       ],
       "by_lifecycle": {
-        "active": 105,
+        "active": 106,
         "archived": 0,
         "deprecated": 0,
         "experimental": 1
       },
       "by_trust_level": {
         "advisory": 0,
-        "core": 104,
+        "core": 105,
         "experimental": 1,
         "professional": 1,
         "restricted": 0
@@ -669,8 +670,9 @@
     },
     {
       "always_on": false,
-      "artefact_count": 11,
+      "artefact_count": 12,
       "artefacts": [
+        "src/rules/cross-source-consistency.md",
         "src/skills/churn-prevention/SKILL.md",
         "src/skills/estimate-ticket/SKILL.md",
         "src/skills/feature-planning/SKILL.md",
@@ -684,14 +686,14 @@
         "src/skills/technical-specification/SKILL.md"
       ],
       "by_lifecycle": {
-        "active": 11,
+        "active": 12,
         "archived": 0,
         "deprecated": 0,
         "experimental": 0
       },
       "by_trust_level": {
         "advisory": 0,
-        "core": 0,
+        "core": 1,
         "experimental": 0,
         "professional": 11,
         "restricted": 0

package/dist/discovery/trust-report.md

@@ -1,6 +1,6 @@
 # Discovery — Trust Report
 
-- Generated: `2026-07-14T09:00:03Z`
+- Generated: `2026-07-14T13:40:54Z`
 - Workspaces tracked: **10**
 - Human-review-required artefacts: **3**
 
@@ -10,13 +10,13 @@
 |---|---|---|---|---|---|
 | `agent-config-maintainer` | 304 | 0 | 3 | 0 | 0 |
 | `construction` | 23 | 0 | 0 | 0 | 0 |
-| `engineering` | 167 | 58 | 2 | 0 | 0 |
+| `engineering` | 168 | 58 | 2 | 0 | 0 |
 | `finance` | 26 | 4 | 0 | 1 | 0 |
 | `founder` | 30 | 0 | 1 | 1 | 0 |
 | `gtm` | 28 | 13 | 1 | 0 | 0 |
 | `legal-review-prep` | 23 | 0 | 0 | 6 | 0 |
 | `ops` | 23 | 8 | 1 | 0 | 0 |
-| `product` | 23 | 15 | 1 | 0 | 0 |
+| `product` | 24 | 15 | 1 | 0 | 0 |
 | `small-business` | 29 | 0 | 19 | 0 | 0 |
 
 ## Human-review-required artefacts