@event4u/agent-config 9.11.0 → 9.13.0

package/src/scripts/check_dependency_floors.ts

@@ -44,11 +44,14 @@ const REPO_ROOT = path.resolve(fileURLToPath(import.meta.url), '..', '..', '..')
  * exact pin cannot suffer the freshest-patch failure (the version is either
  * cached or it is not), but it also forfeits patch fixes — so each one is
  * named here rather than silently tolerated.
+ *
+ * Empty since the code-graph parser pair (`web-tree-sitter` /
+ * `tree-sitter-wasms`) left `dependencies` — it was the only entry. The pair's
+ * ABI pin now lives in `code_graph/loader.ts`'s install hint, because that is
+ * the only place a re-enabler reads it; this gate scans `dependencies` and so
+ * no longer sees the pair at all.
  */
-export const EXACT_PIN_EXCEPTIONS: Readonly<Record<string, string>> = {
-    'web-tree-sitter': 'ABI-locked against tree-sitter-wasms; see code-graph engine pin',
-    'tree-sitter-wasms': 'ABI-locked against web-tree-sitter; see code-graph engine pin',
-};
+export const EXACT_PIN_EXCEPTIONS: Readonly<Record<string, string>> = {};
 
 /**
  * Floors that are non-settled ON PURPOSE, because every version below them is
@@ -74,8 +77,15 @@ const EXACT_VERSION = /^\d+\.\d+\.\d+$/;
 /**
  * Every violation in `dependencies`, as human-readable lines. Empty array
  * means the manifest cannot produce a freshest-patch `ETARGET` for a consumer.
+ *
+ * `exactPinExceptions` defaults to the module's list and is injectable so the
+ * allow-an-exact-pin branch stays covered now that the real list is empty —
+ * otherwise the only way to test it would be to add a fake production entry.
  */
-export function evaluate(dependencies: Readonly<Record<string, string>>): string[] {
+export function evaluate(
+    dependencies: Readonly<Record<string, string>>,
+    exactPinExceptions: Readonly<Record<string, string>> = EXACT_PIN_EXCEPTIONS,
+): string[] {
     const errors: string[] = [];
     for (const [name, range] of Object.entries(dependencies)) {
         const security = SECURITY_FLOOR_EXCEPTIONS[name];
@@ -89,7 +99,7 @@ export function evaluate(dependencies: Readonly<Record<string, string>>): string
             continue;
         }
         if (EXACT_VERSION.test(range)) {
-            if (!(name in EXACT_PIN_EXCEPTIONS)) {
+            if (!(name in exactPinExceptions)) {
                 errors.push(
                     `${name}@${range}: exact pin without an entry in EXACT_PIN_EXCEPTIONS — ` +
                         'add the reason there, or use a settled caret floor (^X.Y.0)',

package/src/scripts/check_gate_coverage.ts

@@ -31,13 +31,13 @@
  * Exit codes: 0 all enforced gates cleared their floor · 1 a gate is blind,
  * collapsed, or silent · 2 the manifest itself is missing/empty/malformed.
  */
-import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import yaml from 'js-yaml';
+import { runCountedProbe } from './_lib/counted_probe.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
@@ -184,11 +184,11 @@ export function classify(
 
 function run_gate(spec: GateSpec): { scanned: number | null; crashed: boolean; exit_code: number | null } {
   const runner = path.join(REPO_ROOT, 'scripts-run');
-  const r = spawnSync(runner, [`src/scripts/${spec.id}`, ...spec.argv], {
-    cwd: REPO_ROOT,
-    encoding: 'utf8',
-  });
-  if (r.error !== undefined || r.status === null) return { scanned: null, crashed: true, exit_code: null };
+  // Bounded read: a gate whose output overflowed would lose its `scanned:`
+  // line and be classified `silent` — the scan-scope guard reporting a dead
+  // scope that is merely truncated. `runCountedProbe` throws instead.
+  const r = runCountedProbe(runner, [`src/scripts/${spec.id}`, ...spec.argv], { cwd: REPO_ROOT });
+  if (r.failure !== null && r.status === null) return { scanned: null, crashed: true, exit_code: null };
   // A gate may legitimately exit non-zero (it found real violations) and still
   // have scanned plenty — coverage and verdict are different questions.
   return { scanned: parse_scanned(`${r.stdout}\n${r.stderr}`), crashed: false, exit_code: r.status };

package/src/scripts/check_installer_import_purity.ts

@@ -0,0 +1,295 @@
+#!/usr/bin/env tsx
+/**
+ * Guard against a maintainer-only CLI being bundled into the consumer installer.
+ *
+ * ## The incident this exists to prevent (road-to-consistent-rule-scoping, 2026-07-31)
+ *
+ * `src/install/rule_scope.ts` imported the rule-scoping predicate from
+ * `src/scripts/condense.ts` — deliberately, so install semantics could not drift
+ * from projection semantics. Correct intent. But `condense.ts` is maintainer CLI
+ * tooling that ends in a module-level self-invoke:
+ *
+ *     const isMain = _isCliEntry();
+ *     if (isMain) { process.exit(main()); }
+ *
+ * `_isCliEntry()` compares `import.meta.url` against `process.argv[1]`. That is
+ * right for a file run directly — and wrong once esbuild BUNDLES the module,
+ * because `import.meta.url` then resolves to the BUNDLE's own URL, which *is*
+ * `argv[1]` when a consumer runs `node dist/install/install.mjs`. The guard
+ * fired inside the installer, `condense.main()` ran, found no maintainer source
+ * tree in a consumer checkout, printed "No source directory found" and called
+ * `process.exit(1)` — killing the install AFTER the payload had already synced.
+ *
+ * All four `smoke-public-install` legs went red. Nothing caught it earlier:
+ * `prepack-check` verifies that imports resolve to SHIPPED paths (they did),
+ * the bundle-freshness gate only byte-diffs the rebuilt output, and the
+ * behavioural smoke test only runs post-push in its own workflow.
+ *
+ * ## What this checks
+ *
+ * The transitive relative-import closure of the installer bundle entry must
+ * contain NO module-level `process.exit(` outside the entry itself.
+ *
+ * "Module-level" is decided structurally, not textually: the AST walk descends
+ * through top-level statements and nested blocks/ifs/try but STOPS at any
+ * function, method, class, arrow or accessor body. So
+ * `function main() { process.exit(1) }` is fine — it only runs when called —
+ * while `if (isMain) { process.exit(main()) }` is not, because importing the
+ * module runs it.
+ *
+ * The entry module is exempt: it IS the CLI, and its own exit is the point.
+ *
+ * ## Why this shape and not the alternatives
+ *
+ * - **Not a string scan of the built bundle.** That reports a mystery literal
+ *   with no cause. This reports the import CHAIN
+ *   (`install.ts → rule_scope.ts → condense.ts`), which is the actionable fact.
+ * - **Not "forbid importing condense.ts".** A denylist of one file rots the
+ *   moment a second CLI module grows an entry guard. The hazard is the
+ *   module-level exit, so that is what is detected.
+ * - **Runs on SOURCE, so it needs no build.** It fails in `task ci` before a
+ *   push instead of on four CI legs after one.
+ *
+ * Exit 0 clean, 1 on any finding. No network, no build, no spend.
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import ts from 'typescript';
+
+const _HERE = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(_HERE, '..', '..');
+
+/**
+ * Bundle entry points that ship to consumers as a single file.
+ *
+ * Keep in sync with the `build:*bundle` scripts in package.json. Each entry is
+ * exempt from the check for its own module-level exit — it is the CLI.
+ */
+const BUNDLE_ENTRIES: readonly string[] = [
+    'src/scripts/install.ts', // → dist/install/install.mjs (build:install-bundle)
+];
+
+interface Finding {
+    /** The offending module, repo-relative POSIX. */
+    readonly module: string;
+    /** 1-indexed line of the offending call. */
+    readonly line: number;
+    /** How the entry reaches it, entry first. */
+    readonly chain: readonly string[];
+}
+
+function toPosix(p: string): string {
+    return p.split(path.sep).join('/');
+}
+
+function relToRepo(abs: string, root: string = REPO_ROOT): string {
+    return toPosix(path.relative(root, abs));
+}
+
+/**
+ * Resolve a relative import specifier to a source file on disk.
+ *
+ * The codebase imports with `.js` extensions (NodeNext) while the sources are
+ * `.ts`, so try the TypeScript twin first, then the literal path, then an
+ * `index` file. Returns `null` for anything unresolvable — a bare package
+ * specifier, a type-only path that no longer exists, or a `.json` asset.
+ */
+function resolveImport(fromFile: string, specifier: string): string | null {
+    if (!specifier.startsWith('.')) return null;
+    const base = path.resolve(path.dirname(fromFile), specifier);
+    const candidates = [
+        base.replace(/\.js$/, '.ts'),
+        base.replace(/\.js$/, '.tsx'),
+        base,
+        `${base}.ts`,
+        path.join(base, 'index.ts'),
+    ];
+    for (const c of candidates) {
+        try {
+            if (fs.statSync(c).isFile()) return c;
+        } catch {
+            // next candidate
+        }
+    }
+    return null;
+}
+
+/** Relative import specifiers declared by `source`, in source order. */
+function importSpecifiers(source: ts.SourceFile): string[] {
+    const out: string[] = [];
+    const visit = (node: ts.Node): void => {
+        if (
+            (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) &&
+            node.moduleSpecifier !== undefined &&
+            ts.isStringLiteral(node.moduleSpecifier)
+        ) {
+            out.push(node.moduleSpecifier.text);
+        } else if (
+            ts.isCallExpression(node) &&
+            node.expression.kind === ts.SyntaxKind.ImportKeyword &&
+            node.arguments.length > 0 &&
+            ts.isStringLiteral(node.arguments[0] as ts.Node)
+        ) {
+            // A dynamic import() is still bundled by esbuild unless code-split,
+            // so it carries the same hazard as a static one.
+            out.push((node.arguments[0] as ts.StringLiteral).text);
+        }
+        ts.forEachChild(node, visit);
+    };
+    ts.forEachChild(source, visit);
+    return out;
+}
+
+/** True for nodes whose body only runs when called — the walk stops here. */
+function isDeferredScope(node: ts.Node): boolean {
+    return (
+        ts.isFunctionDeclaration(node) ||
+        ts.isFunctionExpression(node) ||
+        ts.isArrowFunction(node) ||
+        ts.isMethodDeclaration(node) ||
+        ts.isConstructorDeclaration(node) ||
+        ts.isGetAccessorDeclaration(node) ||
+        ts.isSetAccessorDeclaration(node) ||
+        ts.isClassDeclaration(node) ||
+        ts.isClassExpression(node)
+    );
+}
+
+/** Is `node` a `process.exit(...)` call? */
+function isProcessExitCall(node: ts.Node): boolean {
+    if (!ts.isCallExpression(node)) return false;
+    const callee = node.expression;
+    if (!ts.isPropertyAccessExpression(callee)) return false;
+    return (
+        ts.isIdentifier(callee.expression) &&
+        callee.expression.text === 'process' &&
+        callee.name.text === 'exit'
+    );
+}
+
+/**
+ * 1-indexed lines of every `process.exit(` that executes at MODULE LOAD.
+ *
+ * Descends through statement-level structure (blocks, if/else, try/catch/finally,
+ * loops, labels) and stops at any deferred scope, so a call inside a function is
+ * not reported while one inside a top-level `if` is.
+ */
+function moduleLevelExitLines(source: ts.SourceFile): number[] {
+    const lines: number[] = [];
+    const visit = (node: ts.Node): void => {
+        if (isDeferredScope(node)) return;
+        if (isProcessExitCall(node)) {
+            lines.push(source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1);
+        }
+        ts.forEachChild(node, visit);
+    };
+    ts.forEachChild(source, visit);
+    return lines;
+}
+
+function parse(file: string): ts.SourceFile | null {
+    let text: string;
+    try {
+        text = fs.readFileSync(file, 'utf-8');
+    } catch {
+        return null;
+    }
+    return ts.createSourceFile(file, text, ts.ScriptTarget.ESNext, true);
+}
+
+/**
+ * Walk one entry's closure; return every module-level exit found below it.
+ *
+ * `root` defaults to the repo; tests pass a fixture tree so the chain-reporting
+ * itself is covered, not only the per-file detector.
+ */
+function auditEntry(entryRel: string, root: string = REPO_ROOT): Finding[] {
+    const entryAbs = path.join(root, entryRel);
+    if (!fs.existsSync(entryAbs)) {
+        process.stderr.write(
+            `check-installer-import-purity: entry ${entryRel} does not exist — ` +
+                'update BUNDLE_ENTRIES\n',
+        );
+        process.exitCode = 1;
+        return [];
+    }
+    const findings: Finding[] = [];
+    const seen = new Set<string>([entryAbs]);
+    // BFS so the reported chain is a shortest path — the least confusing one.
+    const queue: Array<{ file: string; chain: string[] }> = [
+        { file: entryAbs, chain: [entryRel] },
+    ];
+    while (queue.length > 0) {
+        const { file, chain } = queue.shift() as { file: string; chain: string[] };
+        const source = parse(file);
+        if (source === null) continue;
+
+        // The entry is the CLI; its own module-level exit is intended.
+        if (file !== entryAbs) {
+            for (const line of moduleLevelExitLines(source)) {
+                findings.push({ module: relToRepo(file, root), line, chain });
+            }
+        }
+
+        for (const spec of importSpecifiers(source)) {
+            const target = resolveImport(file, spec);
+            if (target === null || seen.has(target)) continue;
+            seen.add(target);
+            queue.push({ file: target, chain: [...chain, relToRepo(target, root)] });
+        }
+    }
+    return findings;
+}
+
+function main(): number {
+    const all: Finding[] = [];
+    for (const entry of BUNDLE_ENTRIES) {
+        all.push(...auditEntry(entry));
+    }
+    if (all.length === 0) {
+        process.stdout.write(
+            `✅  installer import purity: ${BUNDLE_ENTRIES.length} bundle entr` +
+                `${BUNDLE_ENTRIES.length === 1 ? 'y' : 'ies'} reach no module-level ` +
+                'process.exit()\n',
+        );
+        return 0;
+    }
+    process.stdout.write('❌  installer import purity — module-level process.exit() reachable:\n');
+    for (const f of all) {
+        process.stdout.write(`\n    ${f.module}:${f.line}\n`);
+        process.stdout.write(`      reached via: ${f.chain.join(' → ')}\n`);
+    }
+    process.stdout.write(
+        '\n  Why this fails the build: esbuild bundles the whole closure into\n' +
+            '  dist/install/install.mjs. A module-level process.exit() then runs when a\n' +
+            '  CONSUMER loads the installer — and a CLI entry guard comparing\n' +
+            '  import.meta.url to process.argv[1] evaluates TRUE inside a bundle, because\n' +
+            '  the bundle IS argv[1].\n\n' +
+            '  Fix: move the code the installer actually needs into a module with no CLI\n' +
+            '  entry and no top-level exit, and let the CLI re-export it. Do NOT relax\n' +
+            '  this gate — the failure it prevents kills a consumer install after the\n' +
+            '  payload has already been written.\n',
+    );
+    return 1;
+}
+
+const _isCliEntry = (): boolean => {
+    if (process.argv[1] === undefined) return false;
+    try {
+        return (
+            fs.realpathSync(fileURLToPath(import.meta.url)) ===
+            fs.realpathSync(path.resolve(process.argv[1]))
+        );
+    } catch {
+        return false;
+    }
+};
+
+if (_isCliEntry()) {
+    process.exit(main());
+}
+
+export { auditEntry, moduleLevelExitLines, BUNDLE_ENTRIES };

package/src/scripts/check_kernel_rule_bundle.ts

@@ -36,6 +36,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { KERNEL_RULE_FILENAMES } from './_lib/kernel_rules.js';
+import { runCountedProbe } from './_lib/counted_probe.js';
 
 const KERNEL_RULES: ReadonlySet<string> = KERNEL_RULE_FILENAMES;
 
@@ -56,13 +57,13 @@ const KERNEL_DIR = 'src/rules';
 const DEFAULT_LABEL = 'bundled-always-rules-acknowledged';
 
 function _git_changed_files(base_ref: string): string[] {
-    const res = spawnSync('git', ['diff', '--name-only', `${base_ref}...HEAD`], {
-        encoding: 'utf8',
-    });
+    // Bounded read: a truncated diff would shrink the change set and let the
+    // bundle guard pass on files it never saw.
+    const res = runCountedProbe('git', ['diff', '--name-only', `${base_ref}...HEAD`]);
     // Python uses check_output(stderr=STDOUT, text=True): on non-zero it raises
     // CalledProcessError and the handler prints the combined output. spawnSync
     // does not raise; mirror by checking status and combining stdout+stderr.
-    if (res.status !== 0) {
+    if (!res.ok) {
         const combined = `${res.stdout ?? ''}${res.stderr ?? ''}`;
         process.stderr.write(`❌  git diff failed: ${combined.trim()}\n`);
         return [];

package/src/scripts/check_token_quality_golden.ts

@@ -113,20 +113,6 @@ export function router_triggers(router: Json): Map<string, Array<Record<string,
   return map;
 }
 
-// trigger_coverage.ts word semantics: lowercase alpha-led tokens, len > 2.
-const _WORD = /[a-z][a-z0-9_]+/g;
-
-function _tokens(text: string): Set<string> {
-  const out = new Set<string>();
-  const low = text.toLowerCase();
-  _WORD.lastIndex = 0;
-  let m: RegExpExecArray | null;
-  while ((m = _WORD.exec(low)) !== null) {
-    if (m[0].length > 2) out.add(m[0]);
-  }
-  return out;
-}
-
 /**
  * Whether a task exercises ≥1 trigger of the rule (prompt↔trigger
  * falsifiability, Phase 3). Kernel rules always fire.
@@ -140,16 +126,12 @@ export function task_fires_rule(
   if (kernel.has(ruleId)) return true;
   const triggers = router_triggers(router).get(ruleId) ?? [];
   const low = task.prompt.toLowerCase();
-  const toks = _tokens(task.prompt);
   const files = Array.isArray(task.context_files) ? task.context_files : [];
   const cmd = typeof task.command === 'string' ? task.command : '';
   for (const trig of triggers) {
     if ('keyword' in trig || 'phrase' in trig) {
       const needle = String(trig.keyword ?? trig.phrase).toLowerCase();
       if (needle && low.includes(needle)) return true;
-    } else if ('intent' in trig) {
-      const words = _tokens(String(trig.intent));
-      if (words.size > 0 && [...words].every((w) => toks.has(w))) return true;
     } else if ('path_prefix' in trig) {
       const prefix = String(trig.path_prefix);
       if (files.some((f) => f.startsWith(prefix))) return true;

package/src/scripts/code_graph/loader.ts

@@ -2,10 +2,11 @@
  * WASM tree-sitter loader for the code-graph engine.
  *
  * Pinned pair (ABI-verified 2026-07-23): `web-tree-sitter@0.24.7` +
- * `tree-sitter-wasms@0.1.13` → grammar ABI 14. The ABI smoke test
- * (`tests/scripts/code_graph_abi.test.ts`) asserts this pairing loads and
- * parses before merge; a bump to either dependency re-runs it. No network,
- * no node-gyp — grammars load from `node_modules` via the resolved path.
+ * `tree-sitter-wasms@0.1.13` → grammar ABI 14. The ABI smoke test lives in
+ * `tests/scripts/code_graph.test.ts`; it runs in this repo because the pair is
+ * a devDependency. Consumers install neither (see `INSTALL_HINT` below). No
+ * network, no node-gyp — grammars load from `node_modules` via the resolved
+ * path.
  *
  * web-tree-sitter 0.24.x is CJS with a single default export (the Parser
  * class) and the classic `Parser.Language.load()` API; we reach it through
@@ -51,10 +52,32 @@ interface ParserStatic {
     Language: { load(wasmPath: string): Promise<TsLanguage> };
 }
 
+/**
+ * The parser pair is a devDependency, not a runtime one: this repo's tests still
+ * exercise the loader, while a consumer install resolves neither. The engine is
+ * permanently `enabled: false` (measured recall 0.365 vs grep 0.797), so
+ * shipping ~51 MB of WASM to every consumer for a path none of them can reach
+ * was pure install cost. A consumer re-enabling the engine installs the
+ * ABI-locked pair themselves — this message carries the pin, because
+ * `check_dependency_floors` only scans the `dependencies` block.
+ */
+const INSTALL_HINT =
+    'the code-graph engine needs its parser pair, which this package no longer ships to consumers ' +
+    '(the engine is disabled by a recorded null result). Install the ABI-locked pair:\n' +
+    '  npm i web-tree-sitter@0.24.7 tree-sitter-wasms@0.1.13\n' +
+    'Both versions are exact on purpose — the pair is ABI-coupled (grammar ABI 14) ' +
+    'and must move together.';
+
 let _wasmDir: string | null = null;
 function wasmDir(): string {
     if (_wasmDir === null) {
-        _wasmDir = path.join(path.dirname(require.resolve('tree-sitter-wasms/package.json')), 'out');
+        let pkgJson: string;
+        try {
+            pkgJson = require.resolve('tree-sitter-wasms/package.json');
+        } catch {
+            throw new Error(`tree-sitter-wasms is not installed — ${INSTALL_HINT}`);
+        }
+        _wasmDir = path.join(path.dirname(pkgJson), 'out');
     }
     return _wasmDir;
 }
@@ -72,7 +95,13 @@ function _Parser(): ParserStatic {
     // Require exactly once and cache the class reference — repeated
     // createRequire calls under tsx can hand back a module view whose static
     // `Language` is not yet populated, which breaks the second grammar load.
-    if (_mod === null) _mod = require('web-tree-sitter') as ParserStatic;
+    if (_mod === null) {
+        try {
+            _mod = require('web-tree-sitter') as ParserStatic;
+        } catch {
+            throw new Error(`web-tree-sitter is not installed — ${INSTALL_HINT}`);
+        }
+    }
     return _mod;
 }
 

package/src/scripts/compile_router.ts

@@ -73,14 +73,9 @@ const LEGACY_TIER_MAP: Record<string, string> = {
 };
 
 const ALLOWED_TIERS = new Set(['kernel', 'tier-1', 'tier-2']);
-const ALLOWED_TRIGGER_KEYS = new Set([
-    'keyword',
-    'phrase',
-    'intent',
-    'file_pattern',
-    'path_prefix',
-    'command',
-]);
+// `intent` was removed: it never auto-matched at runtime, so declaring one gave
+// the author a false activation path. Compiling one is now a hard error.
+const ALLOWED_TRIGGER_KEYS = new Set(['keyword', 'phrase', 'file_pattern', 'path_prefix', 'command']);
 
 function _parse_frontmatter(text: string): JsonObject {
     if (!text.startsWith('---\n')) {

package/src/scripts/condense.ts

@@ -238,6 +238,13 @@ function _stripChars(s: string, chars: string): string {
 // the repo root.
 // =============================================================================
 
+// road-to-consistent-rule-scoping: the predicate moved to a side-effect-free
+// module so the consumer installer can import it WITHOUT pulling this file's
+// module-level CLI self-invoke into its bundle. Re-exported here because four
+// in-repo consumers import it from `condense.js`.
+export { rule_in_scope } from '../install/ruleInScope.js';
+import { rule_in_scope } from '../install/ruleInScope.js';
+
 const _HERE = path.dirname(fileURLToPath(import.meta.url)); // <repo>/src/scripts
 const _DEFAULT_PROJECT_ROOT = path.resolve(_HERE, '..', '..');
 
@@ -1014,34 +1021,6 @@ function _read_rule_packs(): string[] | null {
  * `null` (no role filtering), so every existing 2- and 3-arg call site
  * compiles and behaves unchanged.
  */
-export function rule_in_scope(
-    source_path: string,
-    scope: readonly string[] | null,
-    pack_scope: readonly string[] | null = null,
-    role_scope: readonly string[] | null = null,
-): boolean {
-    if (scope === null && pack_scope === null && role_scope === null) {
-        return true;
-    }
-    const [meta] = _parse_frontmatter(_readText(source_path));
-    if (meta['type'] === 'always' || meta['alwaysApply'] === true) {
-        return true; // kernel always projects
-    }
-    const axis = (key: string, configured: readonly string[] | null): boolean => {
-        if (configured === null) {
-            return true;
-        }
-        const values = Array.isArray(meta[key])
-            ? (meta[key] as unknown[]).map((w) => String(w))
-            : [];
-        if (values.length === 0) {
-            return true; // untagged → fail safe: ship it
-        }
-        return values.some((v) => configured.includes(v));
-    };
-    return axis('workspaces', scope) && axis('packs', pack_scope) && axis('roles', role_scope);
-}
-
 /** List rule basenames under RULES_SOURCE, workspace/pack scope applied. */
 function _scoped_rule_basenames(): string[] {
     const scope = _read_rule_workspaces();
@@ -1197,7 +1176,7 @@ function _yaml_scalar(value: string): string {
  * Derive host-native activation globs from a rule's `triggers:` frontmatter
  * (road-to-request-scoped-rule-load Phase 2). `file_pattern` triggers map
  * verbatim; `path_prefix` triggers map to `<prefix>**`. Keyword / phrase /
- * intent / command triggers produce no glob — those rules stay
+ * command triggers produce no glob — those rules stay
  * description-activated (Cursor Agent-Requested / Windsurf model_decision).
  */
 export function derive_trigger_globs(meta: Record<string, unknown>): string[] {
@@ -1245,7 +1224,7 @@ export function _emit_windsurf_rule(source: string, target: string): void {
     const description = _strip(String(meta['description'] ?? '').replace(/\n/g, ' '));
     const always_apply = Boolean(meta['alwaysApply'] || meta['type'] === 'always');
     // Path-shaped triggers activate host-natively via Windsurf's `glob`
-    // trigger; keyword/intent-only rules keep `model_decision`.
+    // trigger; keyword/phrase-only rules keep `model_decision`.
     const globs = always_apply ? [] : derive_trigger_globs(meta);
     const trigger = always_apply ? 'always_on' : globs.length > 0 ? 'glob' : 'model_decision';
     const lines = [

package/src/scripts/explain_run.ts

@@ -130,7 +130,6 @@ function parseSince(since: string | null): number | null {
 export interface TriggerSpec {
     keyword?: string;
     phrase?: string;
-    intent?: string;
     file_pattern?: string;
     path_prefix?: string;
     command?: string;

package/src/scripts/generate_pack_manifests.ts

@@ -17,7 +17,7 @@
  * regenerated on every `task sync` and must never be hand-edited.
  *
  * For each pack home we emit:
- *   - `<home>/pack.yaml` — id, label, owner, requires, version, artefact_count, …
+ *   - `<home>/pack.yaml` — id, label, owner, requires, artefact_count, …
  *   - `<home>/README.md` — pack description + per-artefact description table
  *
  * CLI:
@@ -40,7 +40,6 @@ const PACKAGES = path.join(ROOT, 'packages');
 const SRC_DOMAINS = path.join(ROOT, 'src', 'domains');
 const SRC_PACKS = path.join(ROOT, 'src', 'packs');
 const PACKS_VOCAB = path.join(ROOT, 'src', 'config', 'discovery', 'packs.yml');
-const PACKAGE_JSON = path.join(ROOT, 'package.json');
 const GENERATED_HEADER =
     '# Generated by scripts/generate_pack_manifests.ts — DO NOT EDIT BY HAND\n';
 
@@ -138,14 +137,6 @@ function _vocab_lookup(packsVocab: Dict[]): Record<string, Dict> {
     return out;
 }
 
-function _package_version(): string {
-    if (!_exists(PACKAGE_JSON)) {
-        return '0.0.0';
-    }
-    const pkg = JSON.parse(fs.readFileSync(PACKAGE_JSON, 'utf-8')) as Dict;
-    return _pyTruthy(pkg.version) ? String(pkg.version) : '0.0.0';
-}
-
 function _artefact_record(p: string, logicalRel: string, fm: Dict): Artefact {
     const name = _pyTruthy(fm.name)
         ? String(fm.name)
@@ -256,12 +247,7 @@ function _category_from_logical(logicalRel: string): string {
  * Build the pack.yaml meta dict. Mirrors `_build_pack_yaml`. Insertion
  * order here is irrelevant — `_py_safe_dump` sorts keys (sort_keys=True).
  */
-function _build_pack_yaml(
-    pid: string,
-    vocab: Record<string, Dict>,
-    artefacts: Artefact[],
-    version: string,
-): Dict {
+function _build_pack_yaml(pid: string, vocab: Record<string, Dict>, artefacts: Artefact[]): Dict {
     const meta = vocab[pid] ?? {};
     const label = _pyTruthy(meta.label)
         ? String(meta.label)
@@ -289,7 +275,6 @@ function _build_pack_yaml(
         trust_level_default: _pyTruthy(meta.trust_level_default)
             ? (meta.trust_level_default as unknown)
             : 'core',
-        version,
         artefact_count: artefacts.length,
     };
     if (_isPlainObject(meta.onboarding)) {
@@ -330,7 +315,6 @@ function _render_readme(packMeta: Dict, artefacts: Artefact[]): string {
     const requires = (packMeta.requires as unknown[]) ?? [];
     lines.push(
         `- **id**: \`${String(packMeta.id)}\``,
-        `- **version**: \`${String(packMeta.version)}\``,
         `- **owner**: ${owner.map(String).join(', ') || '—'}`,
         `- **requires**: ${requires.map(String).join(', ') || '—'}`,
         `- **artefacts**: ${String(packMeta.artefact_count)}`,
@@ -369,7 +353,6 @@ function _write_if_changed(p: string, content: string, check: boolean): boolean
 export function main(argv: string[] = process.argv.slice(2)): number {
     const check = argv.includes('--check');
     const vocab = _vocab_lookup((_load_yaml(PACKS_VOCAB) as Dict[]) ?? []);
-    const version = _package_version();
     const homes = _pack_homes();
     if (homes.length === 0) {
         process.stderr.write(
@@ -380,7 +363,7 @@ export function main(argv: string[] = process.argv.slice(2)): number {
     let drift = 0;
     for (const [pid, homeDir, mode] of homes) {
         const artefacts = _collect_artefacts(pid, homeDir, mode);
-        const meta = _build_pack_yaml(pid, vocab, artefacts, version);
+        const meta = _build_pack_yaml(pid, vocab, artefacts);
         const yamlBody = GENERATED_HEADER + _py_safe_dump(meta);
         const readmeBody = _render_readme(meta, artefacts);
         const label = _relativeToPosix(homeDir, ROOT);