@event4u/agent-config 9.10.0 → 9.12.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Bootstrap shim for the event4u agent-config suite. This plugin ships ONLY the dispatcher hooks plus one install-pointer skill — ALL content (skills, rules, commands) is installed via `npx -y @event4u/agent-config init`, which writes the file projection AND registers the same hooks in ~/.claude/settings.json. DEPRECATED as a content channel; kept so the marketplace listing stays discoverable and existing installs keep working hooks.",
-    "version": "9.10.0",
+    "version": "9.12.0",
     "keywords": [
       "agent-config",
       "skills",

package/CHANGELOG.md

@@ -244,6 +244,117 @@ Entry-shape contract: [`docs/contracts/CHANGELOG-conventions.md`](docs/contracts
 > that forces a new era split (`# Era: 9.11.x`, etc.) — see
 > [`docs/contracts/CHANGELOG-conventions.md § Era splits`](docs/contracts/CHANGELOG-conventions.md).
 
+## [9.12.0](https://github.com/event4u-app/agent-config/compare/9.11.0...9.12.0) (2026-08-01)
+
+### Features
+
+* **corpus:** ship the delivery route and the T7 conflict as data ([3f84502](https://github.com/event4u-app/agent-config/commit/3f8450281ded70ada9283ebaf2e72680a37aa21d))
+* **typography:** branch on hosting mode instead of hard-wiring the import ([47385a1](https://github.com/event4u-app/agent-config/commit/47385a1acee8c9876c187b7ead27cdd23d77f025))
+* **design:** make third-party asset delivery self-hosted by default ([dff1a4c](https://github.com/event4u-app/agent-config/commit/dff1a4c9a51f94fd01e186f98c0e9691378e109d))
+* **work-engine:** overlay composition replaces lane choice ([aef95a6](https://github.com/event4u-app/agent-config/commit/aef95a6a397cb064876379d5cdee0895f981726c))
+* **ci:** settle CI after a push, run preflight before one, confine the copy ([aec0115](https://github.com/event4u-app/agent-config/commit/aec011585ab89e7de2a1789cb3fbdfbb47430902))
+* **skills:** ui-apply-generic — the default lane becomes a real executor ([0930705](https://github.com/event4u-app/agent-config/commit/0930705745fda7eae14dc32a271cb41b8177e381))
+* **work-engine:** multi-axis stack detection ([36b33da](https://github.com/event4u-app/agent-config/commit/36b33dac8a67c627b8e6b863889202768fb23e3e))
+* **ci:** fail the build when the installer can reach a module-level process.exit ([a52c2ad](https://github.com/event4u-app/agent-config/commit/a52c2ad087b0ad7b4dc0eed28a91f70174afc04f))
+
+### Bug Fixes
+
+* **roadmap:** drop an illegal status value from the archived local-ci-trust plan ([c60745e](https://github.com/event4u-app/agent-config/commit/c60745e9cc6e0012437e27849f9e64e5b6368556))
+* **ci:** give release-drift its dependencies so the gate can run at all ([4262f34](https://github.com/event4u-app/agent-config/commit/4262f34df52a9fd092103bdb455b748efa2e5e00))
+* **ci:** make the kernel-prefix gate able to fail, then re-anchor it ([154d366](https://github.com/event4u-app/agent-config/commit/154d36619cac7441c21001fa4c3c1387a54129ce))
+* **design-tokens:** drop the host allow-list that silenced real findings ([4128875](https://github.com/event4u-app/agent-config/commit/4128875432da79e61cc00f7487af09a152c283aa))
+* **skills:** ui-apply-generic ships a consumer-reachable invocation ([98ca19a](https://github.com/event4u-app/agent-config/commit/98ca19aa622582e4c4c85b2d9945030ce038d665))
+* **hooks:** the roadmap gate names its real cause ([1a49867](https://github.com/event4u-app/agent-config/commit/1a49867b41b6eeaa70b45c3d8479a9d9b1ea2399))
+* **install:** keep the projection CLI out of the consumer installer bundle ([802b8fd](https://github.com/event4u-app/agent-config/commit/802b8fd88f1b1fffddbb0e0040359be50d7f5fd2))
+* **install:** scope rules on the CLI global path, not only in the wizard ([9535c57](https://github.com/event4u-app/agent-config/commit/9535c574be9b07801b0721e2625e1bff2cdb2bc2))
+
+### Documentation
+
+* **roadmap:** pre-registration covers the inputs, not only the scoring ([ca90448](https://github.com/event4u-app/agent-config/commit/ca904481823ceed9590f71b685e1621447edacec))
+* **roadmap:** unblock the UI measurements — bench:ui as the port verify stage ([cf9fbf4](https://github.com/event4u-app/agent-config/commit/cf9fbf4ce708d19f679b427aa3856d738cb76bff))
+* **adr:** record one owner for third-party webfont delivery ([dd20e14](https://github.com/event4u-app/agent-config/commit/dd20e148290ecbcad5ba5ac9915c1b5c927dfdce))
+* **roadmap:** merge the coverage benchmark into the tier follow-up ([d08f464](https://github.com/event4u-app/agent-config/commit/d08f46499eeb26af423cd7ae8f34a07cf8a7e9f0))
+* **roadmap:** artefact-count reproducibility as a draft candidate ([850e2c6](https://github.com/event4u-app/agent-config/commit/850e2c689579187b64a481feb2988c2a927d4130))
+* **roadmap:** universal stack coverage — refusal is not coverage ([0bdc726](https://github.com/event4u-app/agent-config/commit/0bdc726ee1ba3a30ff9196e659c14ecce87e12b8))
+* **roadmap:** close road-to-consistent-rule-scoping with its execution notes ([4ca0640](https://github.com/event4u-app/agent-config/commit/4ca0640b30dff0f3a4059083c577622fbb4bbc23))
+
+### Tests
+
+* **work-engine:** baseline the shapes the flat stack label cannot express ([337e4ff](https://github.com/event4u-app/agent-config/commit/337e4ff5eff91439b72a01095329770f6e85eb69))
+* **install:** pin the CLI global deploy against the wizard plan ([5fa64a3](https://github.com/event4u-app/agent-config/commit/5fa64a363cd1d38976cd4ba6583ea1ce90b81238))
+
+### Build
+
+* **install:** refresh the tracked dist/install output for the wizard-plan change ([a2690f3](https://github.com/event4u-app/agent-config/commit/a2690f3f1b9b123f00f505c12f9c9a68d16d2d14))
+
+### Chores
+
+* **funding:** add the sponsor button and say plainly what it is ([a219af6](https://github.com/event4u-app/agent-config/commit/a219af6f68d0fa82291272a726ed81dd2331a7e5))
+* **roadmaps:** archive road-to-webfont-delivery-ownership ([ebfa91d](https://github.com/event4u-app/agent-config/commit/ebfa91dffd260db55d187a71b7c8144eb574596c))
+* **roadmaps:** regenerate the dashboard after the merge ([82c8a45](https://github.com/event4u-app/agent-config/commit/82c8a45b2b2a3f05da1feaf516b6a448ee73fcfe))
+* **roadmaps:** archive the completed rule-scoping roadmap ([5bedc17](https://github.com/event4u-app/agent-config/commit/5bedc17826d26612d1b7db52ded5d5bd2dd694d5))
+
+Tests: 9819 (+77 since 9.11.0)
+
+## [9.11.0](https://github.com/event4u-app/agent-config/compare/9.10.0...9.11.0) (2026-07-31)
+
+### Features
+
+* **doctor:** report detected capability and spend permission as two facts ([9e49347](https://github.com/event4u-app/agent-config/commit/9e4934716bfea7d9c4dcf9c57c7d24c17c6bf980))
+* **detection:** add a read-only, spend-free environment detector ([dcf83cf](https://github.com/event4u-app/agent-config/commit/dcf83cfa589112f4c293ecd665fa9af57905b8d8))
+* **ci:** gate the UI verb→skill-bundle map ([6ed8e49](https://github.com/event4u-app/agent-config/commit/6ed8e4996307ebfb646f2eb1f2fcb3e533e84952))
+* **ci:** measure the install-to-doctor cold start as evidence ([67e258e](https://github.com/event4u-app/agent-config/commit/67e258ef3acb3ae53613a01df2adbba0946bde7e))
+* **ci:** gate the compressed payload and the per-skill share ([09754b2](https://github.com/event4u-app/agent-config/commit/09754b28adf8111ab751b8475a7461849663161b))
+* **cli:** implement the documented --gui opt-in flag ([0b28799](https://github.com/event4u-app/agent-config/commit/0b2879986ddfd6cee3ac8ab2ce367980ccddff12))
+
+### Bug Fixes
+
+* **test:** stop the council CLI test writing an events log into the worktree ([09618d0](https://github.com/event4u-app/agent-config/commit/09618d02cf909b2bca1742b9e40a69ae585baa2a))
+* **doctor:** report the configured mode, not only what `auto` could reach ([bc9c800](https://github.com/event4u-app/agent-config/commit/bc9c800a80a4a8699b216e5e8d4cfe82e39eed86))
+* **work-engine:** distinguish "stack-neutral by definition" from "no executor" ([623c03e](https://github.com/event4u-app/agent-config/commit/623c03ec9ee654dabec9a304836bccfab8706e5d))
+* **test:** drop the removed `name` option from the CliClient construction ([5096049](https://github.com/event4u-app/agent-config/commit/5096049380444c0d4dec091faa84a112257b524b))
+* **install:** ship the council example npm never delivered; align the template ([8e5fe45](https://github.com/event4u-app/agent-config/commit/8e5fe4549cad3ce5689b4a2db0899d44575c6f83))
+* **council:** read the configured transport default on every path, add `auto` ([2b975ce](https://github.com/event4u-app/agent-config/commit/2b975ce2ab44d81e2240c5370af93df91bf27c0a))
+* **packs:** make the design layer reachable from a framework-only install ([2eb3bd6](https://github.com/event4u-app/agent-config/commit/2eb3bd6cc8be55633a6af790ba92c8ae5a238006))
+* **work-engine:** make the design brief's own gates enforce what they claim ([8eb5c2e](https://github.com/event4u-app/agent-config/commit/8eb5c2e34fdbd4cb4d9d671443cbccbfdb45917d))
+* **work-engine:** stop sending real stacks into the fallback lane ([a4cb008](https://github.com/event4u-app/agent-config/commit/a4cb008f8fbf8485896638cb24d3c52e6d218938))
+* **work-engine:** close the UI gate holes and make the verb→bundle map explicit ([95a2577](https://github.com/event4u-app/agent-config/commit/95a25778cb30d03fbae5176957fa4d2fbc3647b8))
+* **cli:** precompile the _cli delegate commands so the consumer CLI needs no tsx ([fa51c5a](https://github.com/event4u-app/agent-config/commit/fa51c5a54f250cc08269326b12519d9fdf817cc3))
+* **deps:** restore the @fastify/static security floor and teach the gate about CVE floors ([b8fb7d6](https://github.com/event4u-app/agent-config/commit/b8fb7d601b37162e0995a521d709a53987527ab2))
+* **ci:** silence the SC2046 the archive exclusion exposed ([047391e](https://github.com/event4u-app/agent-config/commit/047391e63a520aa6e8b965ba58a0f5e5f791dd8a))
+* **ci:** keep era-split archives out of the .md-English gate ([cefb5e2](https://github.com/event4u-app/agent-config/commit/cefb5e2c49c96459807cece92e6aa98ce309341a))
+* **changelog:** never archive the release the archive is named after ([d449f5f](https://github.com/event4u-app/agent-config/commit/d449f5fdec0387421a72bfd185aedc233c4f4b68))
+* **install:** make the ETARGET failure unreachable instead of documented ([41f6bd5](https://github.com/event4u-app/agent-config/commit/41f6bd56b5d20d7675ee4fc86a6540d390785851))
+
+### Documentation
+
+* **roadmap:** close road-to-zero-ceremony-detection and its three blockers ([38fee07](https://github.com/event4u-app/agent-config/commit/38fee07b6121a97fe65f6c249a5c94f71923a8b8))
+* **security:** pin CLAUDE_CONFIG_DIR inheritance as accepted risk ([5a3b580](https://github.com/event4u-app/agent-config/commit/5a3b5804b0cdadb1ba3ccf36a3159bf42bddbd18))
+* **contracts:** make the design contracts describe the machine that exists ([11fe8d2](https://github.com/event4u-app/agent-config/commit/11fe8d237d72c98b9ff37fbc8022cea94efcb1bd))
+* **roadmap:** frontend-stack findings, the council cut, and three roadmaps ([73b8b83](https://github.com/event4u-app/agent-config/commit/73b8b83334289a1fe8dd2d57728ba31aa6c2d243))
+* **contracts:** resolve the UI dispatch contradiction between the two contracts ([a0ec1a3](https://github.com/event4u-app/agent-config/commit/a0ec1a3e29e9f3c4625b5a510ad32b4232373b2b))
+* **adr:** record ADR-204 and correct the falsified Phase 1 claim ([249a5d9](https://github.com/event4u-app/agent-config/commit/249a5d9e54e9d592491c5e922d95bea0b8efd7a2))
+* **roadmap:** close zero-ceremony-install, promote the one defect it found ([e35be42](https://github.com/event4u-app/agent-config/commit/e35be426afdeba04f4dbdeda968a12a78ba39681))
+* **architecture:** stop calling the consumer install "Pipeline B" ([d53ec83](https://github.com/event4u-app/agent-config/commit/d53ec8340468e5e5eb23a0f98d6d2a9ab6dffa90))
+* **install:** make every install statement true of the code that runs ([7ff4c76](https://github.com/event4u-app/agent-config/commit/7ff4c76858f093393e350a77561ab9798efc47a5))
+
+### Tests
+
+* **work-engine:** pin the UI lane matrix as the dispatch baseline ([c9f4f4d](https://github.com/event4u-app/agent-config/commit/c9f4f4d59bca7ab1c848be72bcace44aecdbb1be))
+* **cli:** pin the tsx-free consumer command surface structurally ([fa99997](https://github.com/event4u-app/agent-config/commit/fa99997b53f4afb657fa37e70f559bbc02491c18))
+
+### CI
+
+* register the dependency-floor and pack-size gates ([104b04f](https://github.com/event4u-app/agent-config/commit/104b04f9a80e13c9c37a24bfd1af73d21328ad92))
+
+### Chores
+
+* **test:** drop dead subprocess-era helpers from the doctor test ([5e1d569](https://github.com/event4u-app/agent-config/commit/5e1d56918c8afcc40839f4c20da128d12a5ea840))
+* **roadmaps:** archive the completed detection roadmap ([5c2ae87](https://github.com/event4u-app/agent-config/commit/5c2ae87eb624375a5dace26f6fae28251634ed42))
+* **dist:** rebuild dist/install after the pipeline-naming comment change ([993e511](https://github.com/event4u-app/agent-config/commit/993e5119660d1e91583407aeaa3ebde82f92f533))
+
+Tests: 9742 (+272 since 9.10.0)
+
 ## [9.10.0](https://github.com/event4u-app/agent-config/compare/9.9.0...9.10.0) (2026-07-31)
 
 ### Features

package/README.md

@@ -4,7 +4,7 @@
 
 [![Smoke](https://github.com/event4u-app/agent-config/actions/workflows/smoke.yml/badge.svg)](https://github.com/event4u-app/agent-config/actions/workflows/smoke.yml) [![Public install smoke (3 OS × 2 Node)](https://github.com/event4u-app/agent-config/actions/workflows/smoke-public-install.yml/badge.svg)](https://github.com/event4u-app/agent-config/actions/workflows/smoke-public-install.yml) [![npm](https://img.shields.io/npm/v/@event4u/agent-config?style=flat-square&label=npm&color=orange)](https://www.npmjs.com/package/@event4u/agent-config) [![agent-config MCP server](https://glama.ai/mcp/servers/event4u-app/agent-config/badges/score.svg)](https://glama.ai/mcp/servers/event4u-app/agent-config) [![MCP Toplist](https://mcptoplist.com/badge/glama%2Fevent4u-app%2Fagent-config.svg)](https://mcptoplist.com/server/glama%2Fevent4u-app%2Fagent-config)
 
-[![Skills](https://img.shields.io/badge/Skills-286-orange?style=flat-square)](dist/agent-src/skills/) [![Rules](https://img.shields.io/badge/Rules-111-orange?style=flat-square)](dist/agent-src/rules/) [![Commands](https://img.shields.io/badge/Commands-191-orange?style=flat-square)](dist/agent-src/commands/) [![Guidelines](https://img.shields.io/badge/Guidelines-101-orange?style=flat-square)](docs/guidelines/) [![Personas](https://img.shields.io/badge/Personas-29-orange?style=flat-square)](dist/agent-src/personas/) [![Advisors](https://img.shields.io/badge/Advisors-5-orange?style=flat-square)](dist/agent-src/personas/advisors/)
+[![Skills](https://img.shields.io/badge/Skills-287-orange?style=flat-square)](dist/agent-src/skills/) [![Rules](https://img.shields.io/badge/Rules-111-orange?style=flat-square)](dist/agent-src/rules/) [![Commands](https://img.shields.io/badge/Commands-191-orange?style=flat-square)](dist/agent-src/commands/) [![Guidelines](https://img.shields.io/badge/Guidelines-101-orange?style=flat-square)](docs/guidelines/) [![Personas](https://img.shields.io/badge/Personas-29-orange?style=flat-square)](dist/agent-src/personas/) [![Advisors](https://img.shields.io/badge/Advisors-5-orange?style=flat-square)](dist/agent-src/personas/advisors/)
 
 **Try it in 30 seconds** — drop one read-only subagent into any repo and watch it gate "done": `@production-validator check this branch is actually done`. No wizard, no lock-in, nothing else installed — the [30-second wedge ↓](#quickstart) is the whole first step. Start at the proof, not the catalog: **[event4u-app.github.io/agent-config/proof/](https://event4u-app.github.io/agent-config/proof/)**.
 
@@ -113,7 +113,7 @@ shows the wired AIs; [`docs/featured-commands.md`](docs/featured-commands.md)
 lists the end-to-end workflows (`/implement-ticket`, `/work`,
 `/commit`, `/pr:create`). Deeper tour: [2-minute demo](#2-minute-demo--implement-ticket).
 
-**Install scope.** Pick **one** scope per machine — project-local (default, recommended for application repos) or user-global (recommended for tooling repos / dotfiles). The installer refuses a second, conflicting scope via the `scope_guard` pre-flight. Details: [`docs/contracts/install-scopes.md`](docs/contracts/install-scopes.md). Cleanup when needed: `bash scripts/cleanup_other_scope.sh --confirm`.
+**Install scope.** Pick **one** scope per machine — project-local (default, recommended for application repos) or user-global (recommended for tooling repos / dotfiles). The installer refuses a second, conflicting scope via the `scope_guard` pre-flight. Details: [`docs/contracts/install-scopes.md`](docs/contracts/install-scopes.md). Cleanup when needed: `bash src/scripts/cleanup_other_scope.sh --confirm`.
 
 ## Prove it
 
@@ -166,7 +166,15 @@ by hunting mocks/stubs on the shipped path and demanding real-system evidence
 ([what it does](docs/wedge/production-validator/README.md)). Like it? Install the
 full suite:
 
-**Three steps. Five minutes. Browser wizard, no YAML by hand.**
+**One command. Detection-driven — your installed AI tools are found and
+pre-selected. Nothing is written until you click Finish. No YAML by hand.**
+
+Those four are structural: they hold on every run, because they are properties
+of the code path rather than of your machine. How *long* it takes is not one of
+them — that is dominated by network and registry latency, which we do not
+control. The install → `doctor` wall-clock is measured by CI on every umbrella
+run and published with its conditions, as evidence; it is never a promised
+number.
 
 ```bash
 # 1. Install — on a terminal with a display, the browser wizard launches
@@ -180,9 +188,9 @@ npx -y @event4u/agent-config init
 /work "your first real task"
 ```
 
-**Headless / CI:** `init` skips the GUI automatically when `CI` is set, stdout is not a TTY, `--no-ui` is passed, **or** an explicit `--tools=` selection is given — it then runs the non-interactive installer directly. Pass flags (`--profile=developer --tools=claude-code,cursor`); add `--dry-run` to preview writes. The GUI and the CLI share one installer (`scripts/install.ts`), so both produce identical results. Reference: [`docs/wizard.md`](docs/wizard.md).
+**Headless / CI:** `init` skips the GUI automatically on CI, on a non-TTY, on a headless host, and whenever any CLI-mode flag is present — it then runs the non-interactive installer directly. The full opt-out set is listed once, against the code, in [`gui-wizard` § When the GUI is skipped](docs/contracts/gui-wizard.md#when-the-gui-is-skipped). Pass flags (`--profile=developer --tools=claude-code,cursor`); add `--dry-run` to preview writes. The GUI and the CLI share one installer (`src/scripts/install.ts`), so both produce identical results. Reference: [`docs/wizard.md`](docs/wizard.md).
 
-**Pick specific AIs:** `--tools=claude-code,cursor,augment,windsurf,cline,gemini-cli,copilot,roocode,aider,codex,claude-desktop,continue` (any subset). Visual picker: add `--gui` (loopback-bound, CSRF-gated; contract [`gui-wizard`](docs/contracts/gui-wizard.md)).
+**Pick specific AIs:** `--tools=claude-code,cursor,augment,windsurf,cline,gemini-cli,copilot,roocode,aider,codex,claude-desktop,continue` (any subset). Visual picker: add `--gui` (loopback-bound, CSRF-gated; contract [`gui-wizard`](docs/contracts/gui-wizard.md)). `--gui` is an opt-in that forces the wizard past the TTY and headless checks — it does **not** override `CI`, `AGENT_CONFIG_NO_UI`, or a CLI-mode flag; combining it with one of those exits non-zero rather than quietly running the CLI install. On a headless host add `--allow-headless` and connect a browser to the printed URL.
 
 **Verify hook coverage:** `npx @event4u/agent-config hooks:status` prints the per-platform matrix (`--strict` for CI, `--format json` for tooling).
 
@@ -190,17 +198,6 @@ npx -y @event4u/agent-config init
 
 Migrating from a v1.x install? `npx @event4u/agent-config migrate` — full notes in [`docs/migration/v1-to-v2.md`](docs/migration/v1-to-v2.md).
 
-> **`npm error ETARGET` / `No matching version found for <dep>`?** Re-run with a
-> forced fresh metadata fetch:
-> ```bash
-> npx -y --prefer-online @event4u/agent-config init
-> ```
-> This happens when the project's `.npmrc` sets `prefer-offline=true` (or points
-> at a private-registry mirror): npm resolves our dependencies against stale
-> cached metadata that predates a recently published version. `--prefer-online`
-> bypasses the cache for this run; `npm cache verify` fixes it permanently for
-> that machine.
-
 ---
 
 ## What `agent-config` is — and what it isn't
@@ -615,6 +612,13 @@ the file install. Porting the bash dispatcher to native Windows is
 **demand-gated**: a named Windows adopter who cannot use WSL2 or the MCP
 path reopens it (see `agents/roadmaps/` — road-to-credible-install Phase 3).
 
+## Funding
+
+The package is free, MIT, and stays that way — no paid tier, no dual
+licensing. If it saves you time and you want to chip in, the GitHub Sponsor
+button at the top of the repo is the whole mechanism. If you would rather not,
+use it anyway; nothing here is gated on it.
+
 ## License
 
 [MIT](LICENSE).