@event4u/agent-config 9.11.0 → 9.13.0

package/src/scripts/lint_agent_security.ts

@@ -23,10 +23,10 @@
  * Usage:
  *   ./scripts-run src/scripts/lint_agent_security [--sarif artifacts/agent-security.sarif]
  */
-import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { runCountedProbe } from "./_lib/counted_probe.js";
 
 const _HERE = path.dirname(fileURLToPath(import.meta.url));
 
@@ -54,9 +54,10 @@ function _run(script: string): [number, Finding[]] {
   // (capture_output=True, text=True equivalent). Mirrors the retired Python implementation's
   // `subprocess.run([sys.executable, HERE/<child>.py, "--json"])`, now that the
   // children are TypeScript and the `.py` originals are deleted.
-  const proc = spawnSync(tsxBin, [path.join(_HERE, script), "--json"], {
-    encoding: "utf-8",
-  });
+  // Bounded read: a truncated `--json` payload would fail to parse and be
+  // swallowed as zero findings — a security aggregate reporting clean because
+  // it lost the answer. `runCountedProbe` throws on overflow instead.
+  const proc = runCountedProbe(tsxBin, [path.join(_HERE, script), "--json"]);
   let findings: Finding[];
   try {
     const parsed: unknown = JSON.parse((proc.stdout ?? "") || "[]");

package/src/scripts/lint_framework_leakage_allowlist.json

@@ -93,8 +93,8 @@
     {
       "file": "src/skills/supply-chain-intake/SKILL.md",
       "lines": [
-        70,
-        72
+        80,
+        82
       ],
       "reason": "Per-ecosystem check commands in fenced blocks; the pip/composer siblings sit farther apart than the ±10-line window — genuine multi-ecosystem documentation."
     },

package/src/scripts/lint_regression.ts

@@ -64,6 +64,65 @@ const STATUS_ORDER: Record<string, number> = { pass: 0, pass_with_warnings: 1, f
  * baseline worktree-add failure (→ exit 2 in main). */
 class CalledProcessError extends Error {}
 
+/** The baseline ran but produced nothing usable (→ exit 2 in main).
+ *
+ * Distinct from the two DOCUMENTED empty-baseline degradations (no linter file
+ * in the ref; a pre-migration `.py` baseline with no python3). Those are
+ * deliberate. This one is a broken run, and returning an empty baseline for it
+ * silently reclassifies every existing finding as a "new file" — the gate then
+ * fires on an unmodified tree and can never report a real regression, because a
+ * regression needs the file present in both maps. */
+class BaselineCollectionError extends Error {}
+
+/** Give the detached baseline worktree a resolvable module context.
+ *
+ * `git worktree add` checks out tracked files only, so the temp tree has no
+ * `node_modules` and the linter dies on its first bare import. Symlinking the
+ * repo's own install is enough — the baseline runs the ref's linter source
+ * against the ref's artefacts; only the dependency resolution is borrowed. */
+function _link_node_modules(tmpdir: string, repo_root: string): void {
+    const target = path.join(repo_root, 'node_modules');
+    const link = path.join(tmpdir, 'node_modules');
+    if (fs.existsSync(link) || !fs.existsSync(target)) {
+        return;
+    }
+    try {
+        fs.symlinkSync(target, link, 'dir');
+    } catch {
+        // Non-fatal here: a failed link surfaces as a failed baseline run
+        // below, which raises with the real cause rather than degrading.
+    }
+}
+
+/** Re-root the baseline's file keys onto the repo-relative paths the working-tree
+ * run emits.
+ *
+ * The baseline runs with `--repo-root <tmpdir>` and reports absolute paths under
+ * that temp worktree; the working-tree run reports paths relative to the repo.
+ * Left as-is the two maps share no key, so every comparison is vacuous — the
+ * disjoint guard would reject the run outright once the baseline is non-empty. */
+function _relativise(data: LinterJson, tmpdir: string): LinterJson {
+    const roots = new Set<string>([tmpdir]);
+    try {
+        roots.add(fs.realpathSync(tmpdir));
+    } catch {
+        /* the temp dir is about to be removed; the literal prefix still applies */
+    }
+    const strip = (f: string): string => {
+        for (const r of roots) {
+            const prefix = r.endsWith(path.sep) ? r : r + path.sep;
+            if (f.startsWith(prefix)) {
+                return f.slice(prefix.length);
+            }
+        }
+        return f;
+    };
+    return {
+        ...data,
+        results: (data.results ?? []).map((e) => ({ ...e, file: strip(e.file) })),
+    };
+}
+
 /** Run the linter and return parsed JSON. If ref is null, run on working tree.
  *
  * Mirrors `run_linter_json`: for a ref, add a detached temp worktree, run the
@@ -91,6 +150,7 @@ function run_linter_json(ref: string | null, repo_root: string): LinterJson {
             );
         }
         try {
+            _link_node_modules(tmpdir, repo_root);
             // The baseline ref may be pre-migration (`.py`, run via python3) or
             // post-migration (`.ts`, run via tsx). Probe both extensions in both
             // locations and spawn by extension. A historical `.py` ref genuinely
@@ -139,7 +199,17 @@ function run_linter_json(ref: string | null, repo_root: string): LinterJson {
                       encoding: 'utf8',
                   });
             const out = result.stdout ?? '';
-            return out.trim() ? (JSON.parse(out) as LinterJson) : { results: [], summary: {} };
+            if (!out.trim()) {
+                const why =
+                    result.status === 0
+                        ? 'it exited 0 but printed nothing'
+                        : `it exited ${result.status ?? 'null'}`;
+                throw new BaselineCollectionError(
+                    `the baseline linter for '${ref}' produced no output — ${why}.\n` +
+                        `stderr: ${(result.stderr ?? '').trim().split('\n').slice(-6).join('\n')}`,
+                );
+            }
+            return _relativise(JSON.parse(out) as LinterJson, tmpdir);
         } finally {
             spawnSync('git', ['-C', repo_root, 'worktree', 'remove', '--force', tmpdir], {
                 encoding: 'utf8',
@@ -433,6 +503,10 @@ function main(): number {
             );
             return 2;
         }
+        if (e instanceof BaselineCollectionError) {
+            process.stderr.write(`Error: ${e.message}\n`);
+            return 2;
+        }
         throw e;
     }
 
@@ -454,6 +528,22 @@ function main(): number {
         return 2;
     }
 
+    // The same guard's blind spot: an EMPTY baseline against a populated
+    // current tree is not comparable either, and it is the worse failure —
+    // every existing finding is then reported as a "new file", so the gate
+    // fires on an unmodified tree and no real regression can ever surface.
+    // The documented empty-baseline degradations (no linter in the ref; a
+    // pre-migration `.py` baseline with no python3) print their own warning
+    // above and land here on purpose.
+    if (!baseKeys.length && currKeys.length) {
+        process.stderr.write(
+            `Error: the baseline '${args.baseline}' produced no lint results while the ` +
+                `current tree produced ${currKeys.length} — runs are not comparable; ` +
+                'refusing to report. Every finding would be misreported as new.\n',
+        );
+        return 2;
+    }
+
     const delta = compare(baseline_map, current_map);
 
     if (args.format === 'json') {
@@ -528,4 +618,5 @@ export {
     format_text,
     format_markdown,
     main,
+    _relativise,
 };

package/src/scripts/lint_skill_descriptions.ts

@@ -18,11 +18,32 @@
  *                            (em-dash / colon / comma list), no quoted example,
  *                            no imperative-verb lead. A bare topic restatement.
  *
- * (d) is signal-ABSENCE, not a phrase mandate: an imperative house-style
+ * (a)–(d) are signal-ABSENCE checks over every skill: an imperative house-style
  * description ("Writes Laravel PHP — Eloquent, Artisan …") carries routing
  * signal and passes. The farm-generator's name-echo frontmatter is the
  * must-fail specimen.
  *
+ * Two further checks are POSITIVE — they demand something be present — and are
+ * therefore scoped to CLUSTERED skills only (road-to-overlap-truth-and-skill-cut
+ * Phase 5):
+ *
+ *   (e) clustered-no-sibling-routing — the canonical overlap tool pairs this
+ *                            skill with a same-pack sibling at >= the canonical
+ *                            threshold, and the description never names that
+ *                            sibling. Two skills the router cannot tell apart,
+ *                            neither of which says which one loses.
+ *   (f) clustered-no-quoted-phrase — same cluster condition, and the description
+ *                            carries no quoted literal user phrase. In a cluster,
+ *                            the user's own words are the only tie-break the
+ *                            router gets.
+ *
+ * The cluster condition is what keeps these honest. A quoted-phrase mandate
+ * across all ~287 skills is noise, not routing — it would fire on skills with no
+ * neighbour to be confused with. Today the cluster set is EMPTY (the corpus has
+ * no same-pack pair at or above threshold), so (e) and (f) are dormant by
+ * construction and wake up exactly when a new skill lands close to an existing
+ * one. That is the point.
+ *
  * Deterministic, static-config only. Allowlist mirrors lint_skill_originality:
  * `lint_skill_descriptions_allowlist.json`, capped at 20 (autonomous-execution
  * allowlist-growth antipattern — over-cap means the linter is wrong).
@@ -39,6 +60,7 @@ import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath } from 'node:url';
 
+import { OVERLAP_THRESHOLD, _cosine, collect } from './audit_skill_overlap.js';
 import { parse_frontmatter } from './skill_overlap.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -57,10 +79,54 @@ const IMPERATIVE_LEAD_RE =
 
 interface Violation {
     slug: string;
-    code: 'desc-equals-name' | 'duplicated-trigger' | 'triggers-are-name' | 'no-routing-signal';
+    code:
+        | 'desc-equals-name'
+        | 'duplicated-trigger'
+        | 'triggers-are-name'
+        | 'no-routing-signal'
+        | 'clustered-no-sibling-routing'
+        | 'clustered-no-quoted-phrase';
     detail: string;
 }
 
+/** A quoted literal phrase — `'expand this scene'` / `"film-grade scene"`. */
+const QUOTED_PHRASE_RE = /['"`][^'"`]{3,}['"`]/;
+
+/**
+ * Same-pack neighbours at or above the canonical overlap threshold, keyed by
+ * directory slug.
+ *
+ * Uses the canonical instrument, not a second implementation — one metric, one
+ * threshold, one answer. Cross-pack pairs are excluded for the same reason a
+ * cross-pack merge is out of scope: they do not compete for the same install.
+ */
+function computeClusters(root: string, threshold: number = OVERLAP_THRESHOLD): Map<string, string[]> {
+    const clusters = new Map<string, string[]>();
+    const skills = collect(root).map((s) => ({
+        slug: path.basename(path.dirname(s.relpath)),
+        packs: s.packs,
+        vector: s.vector,
+    }));
+    for (let i = 0; i < skills.length; i += 1) {
+        for (let j = i + 1; j < skills.length; j += 1) {
+            const a = skills[i]!;
+            const b = skills[j]!;
+            let sharesPack = false;
+            for (const p of a.packs) {
+                if (b.packs.has(p)) {
+                    sharesPack = true;
+                    break;
+                }
+            }
+            if (!sharesPack) continue;
+            if (_cosine(a.vector, b.vector) < threshold) continue;
+            clusters.set(a.slug, [...(clusters.get(a.slug) ?? []), b.slug]);
+            clusters.set(b.slug, [...(clusters.get(b.slug) ?? []), a.slug]);
+        }
+    }
+    return clusters;
+}
+
 /** A description carries routing signal if it names a condition, leads with an
  * imperative verb, enumerates specifics (em-dash / colon / ≥2 comma segments),
  * or embeds an example query (a quoted phrase). Absence of all four is the defect. */
@@ -89,7 +155,7 @@ function triggerPhrases(desc: string): string[] {
         .filter((p) => p.length >= 3);
 }
 
-function analyseSkill(slug: string, fm: Record<string, string>): Violation[] {
+function analyseSkill(slug: string, fm: Record<string, string>, siblings: readonly string[] = []): Violation[] {
     const out: Violation[] = [];
     const name = fm['name'] ?? slug;
     const desc = (fm['description'] ?? '').trim();
@@ -137,6 +203,25 @@ function analyseSkill(slug: string, fm: Record<string, string>): Violation[] {
         });
     }
 
+    // (e) + (f) fire ONLY for skills the canonical tool put in a cluster.
+    if (siblings.length > 0) {
+        const unrouted = siblings.filter((s) => !desc.includes(s));
+        if (unrouted.length > 0) {
+            out.push({
+                slug,
+                code: 'clustered-no-sibling-routing',
+                detail: `overlaps ${unrouted.map((s) => `\`${s}\``).join(', ')} at or above the canonical threshold, but the description never names ${unrouted.length === 1 ? 'it' : 'them'} — add a sibling-routing clause so the router knows which one loses`,
+            });
+        }
+        if (!QUOTED_PHRASE_RE.test(desc)) {
+            out.push({
+                slug,
+                code: 'clustered-no-quoted-phrase',
+                detail: `clustered with ${siblings.map((s) => `\`${s}\``).join(', ')} but carries no quoted literal user phrase — in a cluster the user's own words are the tie-break`,
+            });
+        }
+    }
+
     return out;
 }
 
@@ -192,13 +277,14 @@ function parseArgs(argv: string[]): Args {
 function main(argv: string[]): number {
     const args = parseArgs(argv);
     const allow = loadAllowlist();
+    const clusters = computeClusters(args.root);
     const violations: Violation[] = [];
     let scanned = 0;
     for (const md of skillMds(args.root)) {
         scanned += 1;
         const slug = path.basename(path.dirname(md));
         const [fm] = parse_frontmatter(fs.readFileSync(md, 'utf-8'));
-        for (const v of analyseSkill(slug, fm)) {
+        for (const v of analyseSkill(slug, fm, clusters.get(slug) ?? [])) {
             if (!allow.has(`${v.slug}::${v.code}`)) violations.push(v);
         }
     }
@@ -216,7 +302,9 @@ function main(argv: string[]): number {
         return 1;
     }
     if (!args.quiet) {
-        process.stdout.write(`✅  lint_skill_descriptions: ${scanned} skill(s) scanned, no description defects.\n`);
+        process.stdout.write(
+            `✅  lint_skill_descriptions: ${scanned} skill(s) scanned (${clusters.size} clustered), no description defects.\n`,
+        );
     }
     return 0;
 }

package/src/scripts/lint_ui_stack_bundles.ts

@@ -31,6 +31,7 @@ import { fileURLToPath } from 'node:url';
 import {
     STACK_BUNDLES,
     type StackBundle,
+    compose_bundle,
 } from '../agent-src/templates/scripts/work_engine/directives/ui/stack_bundles.js';
 
 const QUIET = process.argv.includes('--quiet');
@@ -47,6 +48,29 @@ const STACK_NEUTRAL_PACKS: ReadonlySet<string> = new Set(['engineering-base', 'c
 
 const findings: string[] = [];
 
+/**
+ * Axis combinations the composition must satisfy.
+ *
+ * Not exhaustive over the cross-product — that would be thousands of
+ * meaningless tuples. These are the shapes a real project produces, including
+ * the ones no hand-written lane ever covered (Nuxt over Vue, Astro, Angular,
+ * Livewire without Flux).
+ */
+const _AXIS_COMBOS: ReadonlyArray<Record<string, string>> = [
+    { view: 'blade', reactivity: 'livewire', component_lib: 'flux', css: 'tailwind', meta: 'none' },
+    { view: 'blade', reactivity: 'livewire', component_lib: 'none', css: 'tailwind', meta: 'none' },
+    { view: 'blade', reactivity: 'alpine', component_lib: 'none', css: 'tailwind', meta: 'none' },
+    { view: 'blade', reactivity: 'unknown', component_lib: 'none', css: 'none', meta: 'filament' },
+    { view: 'jsx', reactivity: 'react', component_lib: 'radix', css: 'tailwind', meta: 'none' },
+    { view: 'jsx', reactivity: 'react', component_lib: 'none', css: 'tailwind', meta: 'nextjs' },
+    { view: 'vue-sfc', reactivity: 'vue', component_lib: 'none', css: 'none', meta: 'nuxt' },
+    { view: 'svelte-sfc', reactivity: 'svelte', component_lib: 'none', css: 'none', meta: 'none' },
+    { view: 'astro', reactivity: 'unknown', component_lib: 'none', css: 'none', meta: 'astro' },
+    { view: 'angular-html', reactivity: 'angular', component_lib: 'none', css: 'none', meta: 'none' },
+    { view: 'unknown', reactivity: 'htmx', component_lib: 'none', css: 'none', meta: 'none' },
+    { view: 'none', reactivity: 'none', component_lib: 'none', css: 'tailwind', meta: 'none' },
+];
+
 function skill_path(name: string): string {
     return path.join(SKILLS_DIR, name, 'SKILL.md');
 }
@@ -137,6 +161,13 @@ function main(): number {
         check_lane(lane, STACK_BUNDLES[lane] as StackBundle);
     }
 
+    // The composed shape, not just the hand-written lanes. Dispatch derives a
+    // bundle from axes now, so a combination nobody wrote down by hand can
+    // still be produced — and it has to satisfy the same two properties.
+    for (const combo of _AXIS_COMBOS) {
+        check_lane(`composed(${JSON.stringify(combo)})`, compose_bundle(combo));
+    }
+
     // A lane usable as a fallback must be pack-agnostic, else the fallback
     // itself is the thing that fails for an unpredictable consumer.
     const plain = STACK_BUNDLES['plain'];

package/src/scripts/project_thin_rules.ts

@@ -155,8 +155,8 @@ const _TRIGGER_HINT_LIMIT = 6;
 /** A short, comma-joined sample of the rule's trigger keywords/phrases. */
 function _trigger_hint(fm: string): string {
     const hits: string[] = [];
-    // re.finditer(r'^\s*-\s*(?:keyword|phrase|intent):\s*"?(.+?)"?\s*$', fm, re.MULTILINE)
-    const re = /^\s*-\s*(?:keyword|phrase|intent):\s*"?(.+?)"?\s*$/gm;
+    // re.finditer(r'^\s*-\s*(?:keyword|phrase):\s*"?(.+?)"?\s*$', fm, re.MULTILINE)
+    const re = /^\s*-\s*(?:keyword|phrase):\s*"?(.+?)"?\s*$/gm;
     let m: RegExpExecArray | null;
     while ((m = re.exec(fm)) !== null) {
         hits.push((m[1] as string).trim());

package/src/scripts/release.ts

@@ -357,6 +357,109 @@ const SECTIONS: ReadonlyArray<readonly [string, string | null, readonly string[]
     ['Chores', null, ['chore']],
 ];
 
+// ---------------------------------------------------------------------------
+// Curated head (road-to-release-shape-honesty Phase 2)
+// ---------------------------------------------------------------------------
+
+/**
+ * The five head lines, in the order an operator reads them.
+ *
+ * Reviewers of 9.9.0 and 9.10.0 repeatedly could not tell, from a generated
+ * commit log, which entries change consumer behaviour, which need migration,
+ * which are internal gate repairs, and which ended as nulls. The log is a
+ * faithful record of *what was committed*; it is not a statement of *what
+ * changed for you*. The head is that statement, and it sits above the log
+ * rather than replacing it.
+ *
+ * Wording is taken from `docs/RELEASE_STORY_TEMPLATE.md` rather than invented,
+ * so the package does not end up with two competing definitions of a curated
+ * head.
+ */
+const RELEASE_HEAD_SECTIONS: ReadonlyArray<string> = [
+    'Behaviour changes',
+    'Default changes + migration',
+    'Security and correctness',
+    'Honest nulls',
+    'Known limitations',
+];
+
+/**
+ * Cap on the head, in rendered lines.
+ *
+ * Roughly ten operator-relevant lines: past that it stops being a summary and
+ * becomes a second changelog. The era budget is also finite
+ * (`_lib/changelog_eras.ts`, 250 lines per era), so an unbounded head would
+ * quietly consume it.
+ */
+export const RELEASE_HEAD_CAP_LINES = 10;
+
+/**
+ * The default value of every head line.
+ *
+ * `_none_` and not a placeholder token: for most releases it is the **true**
+ * answer, and a release that genuinely changed no defaults should say so
+ * rather than carry an unfilled marker. That also keeps the skeleton free of
+ * the placeholder prose `output-discipline` bans — there is nothing here that
+ * is wrong-if-shipped, only something that is uninformative-if-unedited.
+ */
+const HEAD_DEFAULT = '_none_';
+
+/**
+ * Render the curated head. Emitted by the generator on every release so it
+ * cannot be forgotten; edited by the maintainer before merge.
+ */
+export function render_release_head(
+    filled: Readonly<Record<string, string>> = {},
+): string[] {
+    const lines: string[] = [
+        '### Release highlights',
+        '',
+        '<!-- Curated head: fill before merge, keep it under ' +
+            `${RELEASE_HEAD_CAP_LINES} lines, and leave \`${HEAD_DEFAULT}\` where it is ` +
+            'genuinely the answer. The generated log below is unchanged. -->',
+    ];
+    for (const label of RELEASE_HEAD_SECTIONS) {
+        const value = (filled[label] ?? '').trim();
+        lines.push(`- **${label}:** ${value === '' ? HEAD_DEFAULT : value}`);
+    }
+    return lines;
+}
+
+/**
+ * Drop commits whose rendered line would be identical.
+ *
+ * The generated log is keyed by SHA, but a reader is not: a cherry-pick, a
+ * re-land, or one change split across branches produces the same
+ * `scope: subject` twice with different SHAs, and the notes then say the same
+ * thing twice with two links. Keyed on `type + scope + subject` — the parts
+ * that reach the rendered line — keeping the first occurrence, so the earliest
+ * SHA stays the citation.
+ *
+ * Breaking commits are never folded into a non-breaking twin: `!` changes what
+ * the line *means*, and collapsing them would hide a breaking change behind a
+ * routine one.
+ */
+export function dedupe_commit_lines(commits: readonly Commit[]): Commit[] {
+    const seen = new Set<string>();
+    const out: Commit[] = [];
+    for (const c of commits) {
+        const key = [c.breaking ? '!' : '', c.type, c.scope ?? '', c.subject].join('\x1f');
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        out.push(c);
+    }
+    return out;
+}
+
+/** Rendered length of the head, for the cap assertion. */
+export function release_head_line_count(head: readonly string[]): number {
+    // The HTML comment is invisible to a reader, so it does not count against
+    // an operator-facing cap.
+    return head.filter((l) => !l.trimStart().startsWith('<!--')).length;
+}
+
 const BREAKING_RE = /^([a-z]+)(\([^)]+\))?!:/;
 const CONVENTIONAL_RE = /^(?<type>[a-z]+)(?:\((?<scope>[^)]+)\))?(?<bang>!)?: (?<subject>.+)$/;
 
@@ -687,7 +790,7 @@ function render_changelog_entry(
     prev: string | null,
     commits: readonly Commit[],
     today: string,
-    opts: { test_trend_line?: string | null } = {},
+    opts: { test_trend_line?: string | null; head?: Readonly<Record<string, string>> } = {},
 ): [string, string] {
     const test_trend_line = opts.test_trend_line ?? null;
     let heading: string;
@@ -706,7 +809,7 @@ function render_changelog_entry(
     }
     grouped['BREAKING CHANGES'] = [];
     const other: Commit[] = [];
-    for (const c of commits) {
+    for (const c of dedupe_commit_lines(commits)) {
         if (c.breaking) {
             grouped['BREAKING CHANGES']!.push(c);
             continue;
@@ -724,7 +827,8 @@ function render_changelog_entry(
         }
     }
 
-    const body_lines: string[] = [];
+    // The curated head sits above the generated log, which stays unchanged.
+    const body_lines: string[] = [...render_release_head(opts.head ?? {})];
     const ordered_labels = ['BREAKING CHANGES', ...SECTIONS.map(([label]) => label)];
     for (const label of ordered_labels) {
         const bucket = grouped[label] ?? [];

package/src/scripts/resolve_lint_scope.ts

@@ -0,0 +1,53 @@
+#!/usr/bin/env tsx
+/**
+ * Print the diff base a content check should compare HEAD against.
+ *
+ * A resolver, not a gate — it decides nothing and blocks nothing. It exists so
+ * the shell-side checks in `.github/workflows/skill-lint.yml` resolve their
+ * scope from the same source as `skill_linter --changed`, instead of hardcoding
+ * `origin/${base_ref}` and going blind on a release PR (the "0 changed corpus
+ * files, INCONCLUSIVE" outcome).
+ *
+ * Usage:
+ *   resolve_lint_scope [--base-ref <ref>] [--json]
+ *
+ * Prints the base ref on stdout and the reason on stderr, so a caller can do
+ *   BASE="$(./scripts-run src/scripts/resolve_lint_scope --base-ref "origin/$X")"
+ * and still see the explanation in the log.
+ *
+ * Exit codes: 0 always — a resolver that cannot widen reports the ordinary
+ * base and says why. Failing here would turn an unresolvable tag into a red
+ * release for the wrong reason; the emptiness decision belongs to the gate.
+ */
+import { resolveContentLintScope } from './_lib/release_scope.js';
+
+export function main(argv: string[]): number {
+    let baseRef: string | undefined;
+    let asJson = false;
+    for (let i = 0; i < argv.length; i += 1) {
+        const a = argv[i] as string;
+        if (a === '--base-ref') {
+            baseRef = argv[i + 1];
+            i += 1;
+        } else if (a.startsWith('--base-ref=')) {
+            baseRef = a.slice('--base-ref='.length);
+        } else if (a === '--json') {
+            asJson = true;
+        }
+    }
+
+    const scope = resolveContentLintScope(baseRef === undefined ? {} : { baseRef });
+    if (asJson) {
+        process.stdout.write(`${JSON.stringify(scope)}\n`);
+        return 0;
+    }
+    process.stderr.write(`resolve_lint_scope: ${scope.reason}\n`);
+    process.stdout.write(`${scope.base}\n`);
+    return 0;
+}
+
+const invokedDirectly =
+    process.argv[1] !== undefined && /resolve_lint_scope\.ts$/.test(process.argv[1]);
+if (invokedDirectly) {
+    process.exit(main(process.argv.slice(2)));
+}

package/src/scripts/router_telemetry.ts

@@ -24,7 +24,6 @@
  *   | `keyword`      | case-insensitive substring inside the prompt text                |
  *   | `phrase`       | case-insensitive substring (multi-word) inside the prompt text   |
  *   | `command`      | case-sensitive prefix on `command:` field (optional context)     |
- *   | `intent`       | informational only — never auto-matches; counted separately      |
  *   | `path_prefix`  | prefix match against any path in `open_files` (optional context) |
  *   | `file_pattern` | fnmatch against any path in `open_files` (optional context)      |
  *
@@ -227,10 +226,6 @@ export function trigger_matches(
     }
     return false;
   }
-  if ("intent" in trigger) {
-    // Intent triggers are informational and never auto-match.
-    return false;
-  }
   return false;
 }
 

package/src/scripts/runtime_dispatcher.ts

@@ -34,6 +34,7 @@ import { build_registry } from './runtime_registry.js';
 import type { ExecutionResult} from './runtime_handler.js';
 import { HandlerError, execute_shell } from './runtime_handler.js';
 import { resolve_level } from './_lib/script_output.js';
+import { validate_tool_declarations } from './tool_registry.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 
@@ -187,6 +188,45 @@ export function dispatch(skillName: string, registry: SkillRuntime[]): DispatchR
                 warnings: [],
             });
         }
+        // Gate integrity — the grant resolves against TRUSTED config, never
+        // against the skill's own frontmatter.
+        //
+        // road-to-governance-invariants Phase 4, property (b). Every field the
+        // three checks above read (`execution_type`, `handler`, `safety_mode`)
+        // comes out of the skill file's own YAML, so a skill that writes
+        // `safety_mode: strict` self-certifies past all of them. `tool-safety`
+        // states "Allowlist only — tool names must match the tool registry",
+        // and `validate_tool_declarations` implemented exactly that — but
+        // nothing called it. Measured before this branch existed: a skill
+        // declaring `allowed_tools: ["NotInRegistry", "Bash(*)"]` dispatched
+        // `ready`.
+        //
+        // Scoped to the automated path deliberately. That is where
+        // `runtime-safety` puts the hard requirement, and it is the path that
+        // would execute with no human in the loop. Assisted skills get a
+        // warning instead (below): blocking them would reject the scoped-grant
+        // syntax (`Bash(scripts-run:*)`) that `tool-safety` itself prefers and
+        // that this two-entry registry does not model.
+        const toolCheck = validate_tool_declarations(skill.allowed_tools);
+        if (!toolCheck.valid) {
+            return new DispatchResult({
+                request: new ExecutionRequest({
+                    skill_name: skill.name,
+                    execution_type: skill.execution_type,
+                    handler: skill.handler,
+                    timeout_seconds: skill.timeout_seconds,
+                    safety_mode: skill.safety_mode,
+                    allowed_tools: skill.allowed_tools,
+                    status: 'blocked',
+                    reason: `Automated skill declares an untrusted tool grant — ${toolCheck.errors.join('; ')}`,
+                }),
+                warnings: [],
+            });
+        }
+    } else if (skill.allowed_tools.length > 0) {
+        // Not silently ignored: an unregistered grant on a human-confirmed
+        // path is surfaced as a warning rather than a block.
+        warnings.push(...validate_tool_declarations(skill.allowed_tools).errors);
     }
 
     // Assisted/automated skill is ready