@event4u/agent-config 9.11.0 → 9.13.0

package/src/scripts/schemas/pack.schema.json

@@ -6,7 +6,7 @@
   "$comment": "Generated by scripts/generate_pack_manifests.py and validated on load by scripts/validate_pack_yaml.py. Schema introduced in road-to-6.0.0-D Phase 0 Step 2. `dependencies` is the artefact-level include graph (skills/rules the pack's commands reference); `requires` is the pack-level hard-dependency graph (must be acyclic — enforced by scripts/lint_pack_dependencies.py).",
   "type": "object",
   "additionalProperties": false,
-  "required": ["id", "version", "artefact_count"],
+  "required": ["id", "artefact_count"],
   "properties": {
     "id": {
       "type": "string",
@@ -58,10 +58,6 @@
     "trust_level_default": {
       "type": "string"
     },
-    "version": {
-      "type": "string",
-      "minLength": 1
-    },
     "artefact_count": {
       "type": "integer",
       "minimum": 0

package/src/scripts/schemas/rule.schema.json

@@ -63,14 +63,13 @@
         "properties": {
           "keyword": {"type": "string"},
           "phrase": {"type": "string"},
-          "intent": {"type": "string"},
           "file_pattern": {"type": "string"},
           "path_prefix": {"type": "string", "description": "Literal path-prefix match pattern the host evaluates against the file the agent is editing — NOT a file reference. The rewriter leaves it verbatim. Source-of-truth rules that must fire on edits under `.agent-src.uncondensed/` keep that prefix here (the prefix ban applies only to `load_context:` and body links — see road-to-path-fixes.md P2.2 / AI-Council 2026-05-06)."},
           "command": {"type": "string"},
           "reason": {"type": "string"}
         }
       },
-      "description": "Router activation triggers (Phase 3 of road-to-kernel-and-router.md). Forbidden on kernel rules, required on non-kernel rules. Schema: docs/contracts/rule-router.md."
+      "description": "Router activation triggers (Phase 3 of road-to-kernel-and-router.md). Forbidden on kernel rules, required on non-kernel rules. Five match keys: keyword, phrase, file_pattern, path_prefix, command. `intent` was removed — it never auto-matched at runtime and only gave rule authors false confidence that an activation path existed; additionalProperties:false now rejects it. Schema: docs/contracts/rule-router.md."
     },
     "routes_to": {
       "type": "array",

package/src/scripts/self_review_gate.ts

@@ -125,79 +125,21 @@ function changedLineCount(baseRef: string, files: string[], cwd: string = REPO_R
 }
 
 // ── Release-PR detection (road-to-feedback-9.2.0-followups Phase 3) ────
-/**
- * A release PR is detected from its own packaging diff (baseRef...HEAD,
- * scoped to CHANGELOG.md + package.json): an added changelog heading and an
- * added package.json version bump, agreeing on the same version. Pure over
- * the patch text — no git call — so it is unit-testable with synthetic
- * patches. See docs/design/release-pr-review-mode.md.
- */
-export function detectReleaseVersion(patchText: string): string | null {
-    const addedLines = patchText
-        .split('\n')
-        .filter((l) => l.startsWith('+') && !l.startsWith('+++'))
-        .map((l) => l.slice(1));
-
-    let changelogVersion: string | null = null;
-    let packageVersion: string | null = null;
-    for (const line of addedLines) {
-        const changelogMatch = /^##\s*\[(\d+\.\d+\.\d+)\]/.exec(line);
-        if (changelogMatch) changelogVersion = changelogMatch[1] ?? null;
-        const packageMatch = /^\s*"version"\s*:\s*"(\d+\.\d+\.\d+)"/.exec(line);
-        if (packageMatch) packageVersion = packageMatch[1] ?? null;
-    }
-    if (changelogVersion && packageVersion && changelogVersion === packageVersion) {
-        return changelogVersion;
-    }
-    return null;
-}
-
-function releaseDetectionPatch(baseRef: string, cwd: string): string {
-    const r = spawnSync('git', ['diff', `${baseRef}...HEAD`, '--', 'CHANGELOG.md', 'package.json'], {
-        cwd,
-        encoding: 'utf8',
-        maxBuffer: 8 * 1024 * 1024,
-    });
-    return (r.stdout ?? '').toString();
-}
-
-/** Impure wrapper: collects the packaging patch via git, then detects. */
-export function detectReleaseVersionFromGit(baseRef: string, cwd: string = REPO_ROOT): string | null {
-    return detectReleaseVersion(releaseDetectionPatch(baseRef, cwd));
-}
-
-/** `major.minor.patch`, tolerating an optional `v` prefix; null if not semver-shaped. */
-function parseSemver(raw: string): [number, number, number] | null {
-    const m = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(raw.trim());
-    if (!m) return null;
-    return [Number(m[1]), Number(m[2]), Number(m[3])];
-}
-
-function semverLessThan(a: [number, number, number], b: [number, number, number]): boolean {
-    const [aMajor, aMinor, aPatch] = a;
-    const [bMajor, bMinor, bPatch] = b;
-    if (aMajor !== bMajor) return aMajor < bMajor;
-    if (aMinor !== bMinor) return aMinor < bMinor;
-    return aPatch < bPatch;
-}
-
-/**
- * Highest semver-shaped tag strictly below `version`, or null if none. Pure
- * over the supplied tag list — no git call. Non-semver tags (branch-backup
- * names etc.) are ignored rather than throwing.
- */
-export function pickPreviousTag(version: string, tags: readonly string[]): string | null {
-    const target = parseSemver(version);
-    if (!target) return null;
-    let best: { raw: string; parsed: [number, number, number] } | null = null;
-    for (const raw of tags) {
-        const parsed = parseSemver(raw);
-        if (!parsed) continue;
-        if (!semverLessThan(parsed, target)) continue;
-        if (!best || semverLessThan(best.parsed, parsed)) best = { raw, parsed };
-    }
-    return best ? best.raw : null;
-}
+//
+// Moved to `_lib/release_scope.ts` so the release-aware content checks reuse
+// this detector instead of re-deriving it (road-to-release-shape-honesty
+// Phase 1). Imported for local use AND re-exported — a bare `export … from`
+// would not bind the names in this module's scope. Public surface unchanged.
+import {
+    detectReleaseVersionFromGit,
+    pickPreviousTag,
+} from './_lib/release_scope.js';
+
+export {
+    detectReleaseVersion,
+    detectReleaseVersionFromGit,
+    pickPreviousTag,
+} from './_lib/release_scope.js';
 
 function listGitTags(cwd: string): string[] {
     const r = spawnSync('git', ['tag'], { cwd, encoding: 'utf8' });

package/src/scripts/skill_linter.ts

@@ -30,7 +30,6 @@
  *   2 = errors
  *   3 = internal error / structural malice
  */
-import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
@@ -44,6 +43,9 @@ import {
     type YamlValue,
 } from './validate_frontmatter.js';
 import { artefact_roots, resolve_logical } from './_lib/agent_src.js';
+import { ProbeOverflowError, runCountedProbe } from './_lib/counted_probe.js';
+import { resolveContentLintScope } from './_lib/release_scope.js';
+import { DeadScopeError, assertScanned } from './_lib/scan_scope.js';
 
 // __file__ equivalent for repo-root derivation (mirrors Python
 // `Path(__file__).resolve().parent.parent.parent` = <repo>/src/scripts → repo).
@@ -166,10 +168,10 @@ const DOUBLE_BLANK_PATTERN = /\n{3,}/;
 const VALID_RULE_TYPES = new Set(['always', 'auto', 'manual']);
 const VALID_RULE_SOURCES = new Set(['package', 'project']);
 
+// `intent` was removed — see compile_router.ts's copy of this allowlist.
 const ROUTER_ALLOWED_TRIGGER_KEYS = new Set([
     'keyword',
     'phrase',
-    'intent',
     'file_pattern',
     'path_prefix',
     'command',
@@ -2428,20 +2430,42 @@ export function gather_candidate_files_under(srcRoot: string): string[] {
     return sortedUnique(out);
 }
 
-export function gather_changed_candidate_files(root: string): string[] {
+/**
+ * The scope `--changed` resolved, for the caller to report.
+ *
+ * Exported alongside the file list because a release PR silently widening its
+ * own scope would be as opaque as the blindness it fixes — the caller prints
+ * this line.
+ */
+export let last_changed_scope_reason = '';
+
+/**
+ * Candidate files changed against the resolved base.
+ *
+ * The base is release-aware (`_lib/release_scope.ts`): on a release PR it
+ * widens to `previous_release_tag...HEAD`, because a release PR's own diff is
+ * the version bump and the changelog — everything substantive landed in the
+ * commits before the cut. Scoped to the PR's own file list this returned
+ * nothing on a 179-commit release, and the gate reported
+ * "0 skills checked, INCONCLUSIVE" and passed.
+ *
+ * `since` pins the base explicitly and wins over detection.
+ */
+export function gather_changed_candidate_files(root: string, since?: string | null): string[] {
+    const scope = resolveContentLintScope({ cwd: root, since: since ?? null });
+    last_changed_scope_reason = scope.reason;
     const diffCommands = [
-        ['git', 'diff', '--name-only', 'origin/main...HEAD'],
+        ['git', 'diff', '--name-only', `${scope.base}...HEAD`],
         ['git', 'diff', '--name-only', '--cached', 'HEAD'],
         ['git', 'diff', '--name-only', 'HEAD'],
     ];
     try {
         let rawLines: string[] = [];
         for (const cmd of diffCommands) {
-            const result = spawnSync(cmd[0] as string, cmd.slice(1), {
-                cwd: root,
-                encoding: 'utf-8',
-            });
-            if (result.status === 0 && (result.stdout ?? '').trim()) {
+            // A truncated diff would silently shrink the change set — the same
+            // degrade-to-zero shape this roadmap closes elsewhere.
+            const result = runCountedProbe(cmd[0] as string, cmd.slice(1), { cwd: root });
+            if (result.ok && result.stdout.trim()) {
                 rawLines = splitlines(result.stdout);
                 break;
             }
@@ -2479,7 +2503,15 @@ export function gather_changed_candidate_files(root: string): string[] {
             }
         }
         return sortedUnique(files);
-    } catch {
+    } catch (exc) {
+        // An overflowed diff is not an empty diff. Everything else (a shallow
+        // clone with no `origin/main`, a detached worktree) legitimately has no
+        // resolvable change set and keeps the historical empty-list degrade.
+        if (exc instanceof ProbeOverflowError) {
+            throw exc;
+        }
+        last_changed_scope_reason =
+            `change set unresolvable (${exc instanceof Error ? exc.message : String(exc)})`;
         return [];
     }
 }
@@ -4082,6 +4114,8 @@ interface Args {
     report: boolean;
     repoRoot: string;
     quiet: boolean;
+    /** Explicit diff base for `--changed`; wins over release detection. */
+    since: string | null;
 }
 
 export function parse_args(argv: string[]): Args {
@@ -4095,6 +4129,7 @@ export function parse_args(argv: string[]): Args {
         condensationQuality: false,
         strictWarnings: false,
         report: false,
+        since: null,
         repoRoot: '.',
         quiet: false,
     };
@@ -4104,6 +4139,15 @@ export function parse_args(argv: string[]): Args {
             args.all = true;
         } else if (a === '--changed') {
             args.changed = true;
+        } else if (a === '--since') {
+            const v = argv[i + 1];
+            i += 1;
+            if (v === undefined || v.startsWith('--')) {
+                throw new ArgError('argument --since: expected a git ref');
+            }
+            args.since = v;
+        } else if (a.startsWith('--since=')) {
+            args.since = a.slice('--since='.length);
         } else if (a === '--format') {
             const v = argv[i + 1];
             i += 1;
@@ -4143,6 +4187,21 @@ export function parse_args(argv: string[]): Args {
 
 class ArgError extends Error {}
 
+/**
+ * True when an empty change set is a defect rather than a legitimate scope.
+ *
+ * Only on a release PR whose scope actually widened to a tag span: a release
+ * that changed no skill and no rule is possible in principle, but a *resolved*
+ * span that matched nothing is the "0 skills checked, INCONCLUSIVE" shape this
+ * gate exists to stop. A release whose previous tag could not be resolved is
+ * excluded — that scope never widened, so failing it would punish a shallow
+ * clone for the wrong reason.
+ */
+function _release_scope_requires_findings(root: string, since?: string | null): boolean {
+    const scope = resolveContentLintScope({ cwd: root, since: since ?? null });
+    return scope.isRelease && scope.previousTag !== null;
+}
+
 export function main(argv: string[]): number {
     let args: Args;
     try {
@@ -4162,7 +4221,8 @@ export function main(argv: string[]): number {
             paths.push(...gather_all_candidate_files(root));
         }
         if (args.changed) {
-            paths.push(...gather_changed_candidate_files(root));
+            paths.push(...gather_changed_candidate_files(root, args.since));
+            process.stderr.write(`skill_linter --changed: ${last_changed_scope_reason}\n`);
         }
         for (const raw of args.paths) {
             const p = path.isAbsolute(raw) ? raw : path.resolve(root, raw);
@@ -4183,6 +4243,28 @@ export function main(argv: string[]): number {
             } else if (args.format === 'json') {
                 process.stdout.write(`${format_json([])}\n`);
             }
+            // A release PR that resolved a real tag span and still matched
+            // nothing has not passed — it examined nothing. Mirrors the
+            // scan-scope regime the other gates already adopted
+            // (`_lib/scan_scope.ts`; exit 2, as `check_iron_law_prominence`).
+            // Ordinary PRs keep the historical exit 0: a change set with no
+            // skill or rule in it is a legitimate empty scope, not a dead one.
+            if (args.changed && _release_scope_requires_findings(root, args.since)) {
+                try {
+                    assertScanned({
+                        gate: 'skill_linter --changed (release PR)',
+                        scanned: 0,
+                        units: 'skill/rule files',
+                        roots: [last_changed_scope_reason],
+                    });
+                } catch (exc) {
+                    if (exc instanceof DeadScopeError) {
+                        process.stderr.write(`❌  ${exc.message}\n`);
+                        return 2;
+                    }
+                    throw exc;
+                }
+            }
             process.stderr.write('No matching skill/rule files found.\n');
             return 0;
         }