@event4u/agent-config 9.12.0 → 9.13.0

package/dist/agent-src/skills/character-consistency/SKILL.md

@@ -181,12 +181,15 @@ Worked example — `creature`:
 
 ## Policies
 
+Paths, enforcement model, and the full set: the
+[media policy preamble](../../../agents/settings/policies/media/README.md).
+
 When a character lock would identify or render a real person, consult before emitting the JSON:
 
-- [`agents/settings/policies/media/likeness.md`](../../../agents/settings/policies/media/likeness.md) — real-person identity tokens require a cited likeness release.
-- [`agents/settings/policies/media/public-figures.md`](../../../agents/settings/policies/media/public-figures.md) — recognised public figures carry the harder gate (publicity rights + transformative-intent).
-- [`agents/settings/policies/media/voice-cloning.md`](../../../agents/settings/policies/media/voice-cloning.md) — when `voice_note` references a real person's voice.
-- [`agents/settings/policies/media/disclosure.md`](../../../agents/settings/policies/media/disclosure.md) — outputs carrying a real-person lock require the non-removable AI-generation disclosure downstream.
+- **`likeness`** — real-person identity tokens require a cited likeness release.
+- **`public-figures`** — recognised public figures carry the harder gate (publicity rights + transformative-intent).
+- **`voice-cloning`** — when `voice_note` references a real person's voice.
+- **`disclosure`** — outputs carrying a real-person lock require the non-removable AI-generation disclosure downstream.
 
 Refuse-and-surface the file path; do not silently sanitise the prompt.
 

package/dist/agent-src/skills/decision-record/SKILL.md

@@ -58,6 +58,14 @@ Do NOT use when:
   get a one-page record; one-way doors get the full options +
   consequences + supersession chain. The reversibility row of the
   matrix decides which template fires. See `mental-models.md` § 10.
+  **Corollary — a shortcut through a one-way door is a decision, not a
+  defer.** The cheap-and-simple option is *preferred* where the choice can
+  be walked back later. Where it cannot — a public API shape, a DB schema,
+  a migration, a wire format, a published identifier — "we can simplify
+  this later" is false, so it never ships as a deferred note; it lands
+  here as a recorded decision with its consequences named. The one-way
+  categories are enumerated so the call is not left to a judgement about
+  what feels important.
 - **Team context-spine slot.** Read the **team** slot of the
   [context-spine](../../../docs/contracts/context-spine.md) to
   capture who is bound by the decision (review groups, on-call

package/dist/agent-src/skills/design-review/SKILL.md

@@ -352,6 +352,17 @@ structured review phases, add an explicit **Anti-Slop Check** section:
 3. Run the AI-slop originality self-test on the overall aesthetic direction.
    Report the result (pass / flag / fail) with one sentence of evidence — this
    is the human judgment the detector deliberately does not make.
+4. **Mark the findings a provided artifact already answers.** When the run is a
+   port (`state.ui_design.provided_artifact` is set), a finding about a
+   decision the artifact makes is correct about the pattern and wrong about the
+   action. Keep it in the output, cite it as **"matches provided spec"**, and
+   set `artifact_covered: true` on it — the polish gate drops those from the
+   round-driving set, so an unmarked finding will send a round at the user's
+   own design. The flag is scoped to decisions the artifact actually covers;
+   anything it leaves open (a state it never showed) is generative work and
+   keeps the full scan. Precedence + scope:
+   [`design-fidelity-mechanics`](../../../docs/guidelines/design-fidelity-mechanics.md)
+   § Provided-artifact precedence. Regression witness: `daf-slop-vs-provided`.
 
 For the **objective quality floors** (WCAG contrast, font-size, line-length,
 reduced-motion, heading hierarchy, focus indicator), do NOT eyeball them —

package/dist/agent-src/skills/design-system-capture/reference/design-system-json.md

@@ -42,6 +42,14 @@
 - **`bundled_local`** on a font family is a flag, not an instruction: the
   package never downloads or bundles fonts (out of scope) — it records that the
   source did.
+- **`motion` has a consumer.** It sits outside the DTCG mapping above, and for
+  a long time that meant nothing read it at all: the block was written by
+  capture and consumed by nobody, so easing and duration were re-derived from
+  taste on every port. On the **Port a provided artifact** branch
+  ([`design-artifact-lifecycle`](../../../../../docs/contracts/design-artifact-lifecycle.md))
+  the audit reads `motion.durations` and `motion.easings` as the answer. The
+  extraction-only marking above still holds: `motion._meta.detected_libs`
+  informs the human and never becomes a token.
 
 ## Trust posture (mandatory)
 

package/dist/agent-src/skills/existing-ui-audit/SKILL.md

@@ -104,9 +104,25 @@ Write into `state.ui_audit.design_tokens` (object, never null — empty object i
 | `:root { --... }` blocks in `resources/css/`, `app/globals.css`, `src/app/globals.css` | every `--token-name: value` pair |
 | `theme.json` / `tokens.json` (any depth) | flat or nested token tree |
 | `app/css/variables.css`, `assets/scss/_tokens.scss` | SCSS `$var: value` and CSS custom properties |
+| **A supplied `design-system.json`** (handed over with a provided artifact) | `colors`, `typography`, `spacing`, `radius`, `shadow`, **and `motion`** (`durations`, `easings`) — read as the answer, never re-derived |
+| **A supplied artifact's own `:root { --… }` / inline `<style>`** (the handover file itself, e.g. `design.html`) | every `--token-name: value` pair, when no `design-system.json` accompanies it |
 
 Group output by category: `colors`, `spacing`, `radius`, `font`, `shadow`, `breakpoint`, `other`.
 
+**Artifact-sourced tokens stay distinguishable from project tokens.** Every
+group carries a `source` — `project` for the first four rows, `artifact` for the
+last two — because the mapping between them is the thing a port has to keep
+visible. Collapsing them loses the answer to "did this value come from what the
+user handed me, or from what the repo already had?", and that is exactly the
+question the apply coverage report has to answer per item. The two sets may
+disagree; when they do, surface the conflict rather than merging it (a supplied
+spec outranks house taste, but not a registered brand token — see
+[`brand-source-of-truth`](../../rules/brand-source-of-truth.md)).
+
+`motion` is new here: the block has existed in the `design-system.json` schema
+since capture shipped and **nothing consumed it**. On the port branch it is
+read, so easing and duration stop being values the brief silently regenerates.
+
 ### 4. Detect shadcn inventory (only when `state.stack.frontend == "react-shadcn"`)
 
 Read `components.json` for the registered style + base color, then read `package.json` for `@radix-ui/*` and any locally vendored `components/ui/*.tsx` files. Write into `state.ui_audit.shadcn_inventory`:
@@ -265,9 +281,24 @@ scheme, border-radius convention, motion patterns), cross-check the findings
 against
 [`docs/guidelines/design-antipatterns.md`](../../../docs/guidelines/design-antipatterns.md).
 If the existing UI already uses a listed anti-pattern, surface it as a design-debt
-finding (separate from the reuse inventory) — flag by entry ID and severity. The
-next design step can then decide whether to continue the existing pattern (for
-consistency) or introduce a corrective direction change.
+finding (separate from the reuse inventory) — flag by entry ID and severity.
+
+**What the design step may then do depends on whose aesthetic it is.** These
+are two different situations and the sentence that used to cover both was
+wrong about one of them:
+
+| The anti-pattern lives in… | The design step may… |
+|---|---|
+| **The consumer's own legacy UI** (inventoried from the repo) | continue it for consistency, **or** propose a corrective direction change. Both are legitimate; it is their codebase and their debt. |
+| **A supplied spec** (a handed-over artifact, a `design-system.json`, a registered brand token) | **neither.** Build it as given. The finding is recorded as informational, marked `artifact_covered`, and no polish round acts on it. |
+
+A corrective direction change against a supplied spec is not a design
+improvement, it is overriding a decision the user already made — the failure
+[`design-fidelity`](../../rules/design-fidelity.md) exists to prevent, arriving
+through the audit's side door. Precedence and its exact scope:
+[`design-fidelity-mechanics`](../../../docs/guidelines/design-fidelity-mechanics.md)
+§ Provided-artifact precedence. Where the two sources disagree, surface the
+conflict rather than picking (fixture `daf-slop-vs-provided`).
 
 ## Do NOT
 

package/dist/agent-src/skills/fe-design/SKILL.md

@@ -340,6 +340,16 @@ If a tell was the first impulse, choose a different approach or explicitly
 justify why this brief calls for it. (The full pre-proposal scan is under
 *Anti-slop discipline* below.)
 
+**Carve-out — a supplied artifact is the spec, not a first impulse.** This
+discipline governs what *you* reach for. When the user hands over a finished
+artifact, the choices it makes are not your impulses and the justify-or-change
+burden does not apply to them: build them as given. The carve-out is scoped to
+decisions the artifact actually covers — anything it leaves open (a state it
+never shows, a surface it never had) is your first impulse again and gets the
+full scan. See
+[`design-fidelity-mechanics`](../../../docs/guidelines/design-fidelity-mechanics.md)
+§ Provided-artifact precedence.
+
 ## Aesthetic direction
 
 Audit-pinned tokens and components always take precedence (see `existing-ui-audit`). When the audit pins an aesthetic, honor it without deviation. When the audit shows **no pinned aesthetic** — greenfield surface, marketing landing page, brand-new feature without design-system precedent — the design brief is allowed (and expected) to commit to a deliberate direction instead of defaulting to safe centered hero + 3-column features + CTA.

package/dist/agent-src/skills/motion-choreographer/SKILL.md

@@ -186,12 +186,15 @@ stdin shape. The orchestrator pipes this into the video adapter's
 
 ## Policies
 
+Paths, enforcement model, and the full set: the
+[media policy preamble](../../../agents/settings/policies/media/README.md).
+
 Motion prompts inherit every constraint the upstream blueprint carries. Before emitting provider-tuned prose:
 
-- [`agents/settings/policies/media/disclosure.md`](../../../agents/settings/policies/media/disclosure.md) — every distributed clip carries the non-removable AI-generation disclosure; refuse adapter flags that would suppress it.
-- [`agents/settings/policies/media/transparency.md`](../../../agents/settings/policies/media/transparency.md) — provider provenance (C2PA / SynthID) is preserved; refuse re-encode flags whose effect is to strip provenance.
-- [`agents/settings/policies/media/voice-cloning.md`](../../../agents/settings/policies/media/voice-cloning.md) — when the motion prompt requests `audio: native` narration in a named voice.
-- [`agents/settings/policies/media/brand-impersonation.md`](../../../agents/settings/policies/media/brand-impersonation.md) — when the motion prompt copies a recognised brand's chyron / mascot / signature transition.
+- **`disclosure`** — every distributed clip carries the non-removable AI-generation disclosure; refuse adapter flags that would suppress it.
+- **`transparency`** — provider provenance (C2PA / SynthID) is preserved; refuse re-encode flags whose effect is to strip provenance.
+- **`voice-cloning`** — when the motion prompt requests `audio: native` narration in a named voice.
+- **`brand-impersonation`** — when the motion prompt copies a recognised brand's chyron / mascot / signature transition.
 
 Refuse-and-surface; the motion prompt cannot launder a policy gap upstream skills should have caught.
 

package/dist/agent-src/skills/overbuild-review-lens/SKILL.md

@@ -0,0 +1,201 @@
+---
+model_tier: high
+name: overbuild-review-lens
+description: "Use when a diff builds more than the task needs — code that should not exist, a dependency the platform already covers, or a clever form where a flat one reads better. Deletion-hunting, not quality."
+personas:
+  - senior-engineer
+domain: quality
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+---
+
+# overbuild-review-lens
+
+> A deletion-hunting lens. It asks one question the other judges never
+> ask: **should this code exist at all?** Sibling of
+> [`architecture-review-lens`](../architecture-review-lens/SKILL.md) and
+> the `judge-*` family — never overlaps with them.
+
+## When to use
+
+- A diff adds a helper, a wrapper, a config layer, an abstraction, or a
+  dependency.
+- A rewrite, v2, or large refactor landed — the peak over-build context
+  (see [`minimal-safe-diff-mechanics`](../../../docs/guidelines/agent-infra/minimal-safe-diff-mechanics.md)
+  § The sanctioned-rewrite trap).
+- A reviewer asks "is all of this needed?", "could the platform do
+  this?", or "why is this so clever?".
+
+Do NOT use when:
+
+- The concern is whether the code is **correct** — route to
+  [`judge-bug-hunter`](../judge-bug-hunter/SKILL.md).
+- The concern is **security** — route to
+  [`judge-security-auditor`](../judge-security-auditor/SKILL.md).
+- The concern is **naming, single-responsibility, or convention fit** of
+  code whose existence is not in question — route to
+  [`judge-code-quality`](../judge-code-quality/SKILL.md). That judge asks
+  *is this code malformed*; this lens asks *should it exist*.
+- The concern is **performance** — route to
+  [`performance`](../performance/SKILL.md). Speed is out of scope here.
+- The diff is documentation-only or formatting-only.
+
+## The scope fence — read this before the first finding
+
+```
+CORRECTNESS, SECURITY AND PERFORMANCE ARE OUT OF SCOPE FOR THIS LENS.
+THE MINIMUM RUNNABLE CHECK IS NEVER FLAGGED FOR DELETION.
+A SIZE REDUCTION THAT DROPS A GUARD IS A LOSS, NOT A FINDING.
+```
+
+The measured failure mode this fence exists for: a bare "make it
+simpler" critic was the only arm in a controlled comparison that dropped
+a safety guard — the three lines it saved were a path-traversal check.
+Tests, validation, authorization checks, tenant scoping, and error paths
+that can actually occur are **not** over-build. If removing something
+would reduce coverage of a real case, it is not a finding here.
+
+## Procedure
+
+### 1. Establish what the task actually asked for
+
+Read the ticket / prompt, not just the diff. Over-build is measured
+against the **requirement**, not against your taste. Anything the diff
+adds beyond the requirement is a candidate; anything the requirement
+demands is not, however large.
+
+### 2. Walk each addition down the solution-size ladder
+
+For every new unit (function, class, module, config key, dependency),
+find the highest rung that would have carried it — see
+[`agent-interaction-and-decision-quality`](../../../docs/guidelines/agent-infra/agent-interaction-and-decision-quality.md)
+§ 8b-ladder:
+
+| Tag | Meaning | The evidence that makes it a finding |
+|---|---|---|
+| `delete:` | This should not exist at all | A fence line (see § 3) — mandatory |
+| `stdlib:` | The language stdlib or framework already does it | Name the exact API and show it is equivalent |
+| `native:` | The OS / runtime / browser / database already does it | Name the platform capability and its availability floor |
+| `yagni:` | Built for a requirement nobody stated | Quote the requirement it exceeds |
+| `shrink:` | Must exist, but smaller | Name the lines that carry no requirement |
+| `flatten:` | Must exist, but in a **simpler form** | Name the cognitive cost, not the line count |
+
+`flatten:` is the shape-axis inverse of `shrink:` — same logic, simpler
+form, **even when that costs a line or two**. Without it the lens only
+ever argues downward and becomes a golfing engine. A nested ternary
+replaced by an `if` block is a valid `flatten:` finding even though the
+diff grows.
+
+### 3. Every `delete:` carries a fence line — no exceptions
+
+Chesterton's Fence, operationalised. Agents are documented as
+especially fence-blind: complex code reads as an invitation to simplify
+when the complexity may exist for a reason the reader has no context
+for. This does not restate
+[`minimal-safe-diff`](../../../src/rules/minimal-safe-diff.md)'s "never
+delete code that *looks* dead without proof" — it is the output contract
+that makes the proof visible.
+
+The fence line has three fields, all required:
+
+```
+Fence: why=<why the code existed — blame, test, issue, or "unknown">
+       safe=<the evidence that removal is safe>
+       covered=<yes|no|partial — was the removed path under test?>
+```
+
+- `why=unknown` is a legal value and it is **not** a pass. It downgrades
+  the finding to a question for the author, never an instruction.
+- `covered=` is the one machine-checkable input to an otherwise
+  archaeological judgement (the Beyoncé rule: if you liked it, you put a
+  test on it). Deleting *tested* behaviour trips a test and is visible;
+  deleting *untested* behaviour breaks silently — so `covered=no` is
+  surfaced as **higher** risk, not as equivalent.
+
+### 4. Emit the null when there is nothing to cut
+
+```
+A LENS THAT CANNOT SAY "NOTHING TO CUT" IS A FINDING GENERATOR.
+```
+
+A lean diff must produce the honest null, not an invented finding. This
+is the load-bearing output, not a fallback: a reviewer who sees findings
+on every diff stops reading them.
+
+### 5. Validate before emitting
+
+- Every finding has a `file:line` and exactly one tag from § 2.
+- Every `delete:` has all three fence fields.
+- No finding restates a correctness, security, or performance concern.
+- The net-lines summary counts `flatten:` findings honestly, including
+  the ones that **add** lines.
+- Zero findings → emit the null block, not an empty issues list.
+
+## Output format
+
+The verdict block carries these ordered fields:
+
+1. `Lens:` — fixed value `overbuild-review-lens`
+2. `Target:` — the diff range or file set reviewed
+3. `Verdict:` — exactly one of `lean` / `trim` / `overbuilt`
+4. `Findings:` — one line per finding: tag, `file:line`, one sentence;
+   `delete:` findings carry their `Fence:` line directly beneath
+5. `Net:` — lines removable if every finding is applied, stated as a
+   signed number so a line-adding `flatten:` is visible
+
+```
+Lens:    overbuild-review-lens
+Target:  <branch / diff range>
+
+Verdict: lean | trim | overbuilt
+
+Findings:
+1. stdlib:  src/util/uuid.ts:1     Hand-rolled v4 generator; crypto.randomUUID covers it.
+2. delete:  src/config/flags.ts:12 Flag read by nothing since the feature shipped.
+   Fence: why=guarded the 2026-03 rollout  safe=zero readers, grep clean  covered=no
+3. flatten: src/parser.ts:88       Nested ternary; an if/else reads flat (+2 lines).
+
+Net: -34 lines
+```
+
+The null, when there is nothing to cut — emit verbatim, do not
+paraphrase:
+
+```
+Lens:    overbuild-review-lens
+Target:  <branch / diff range>
+
+Verdict: lean
+
+Findings: none — nothing in this diff exceeds the stated requirement.
+
+Net: 0 lines
+```
+
+## Gotcha
+
+- **The requirement is the yardstick, not your preference.** A large
+  diff that the ticket demanded is not over-built. Say so and emit the
+  null.
+- **`covered=no` makes a deletion riskier, not more attractive.** The
+  absence of a test is the absence of a tripwire.
+- **A `flatten:` finding that saves lines is suspicious.** If it is
+  shorter *and* simpler it is probably a `shrink:`; `flatten:` exists
+  for the cases where simplicity costs length.
+- **Never flag the minimum runnable check.** One happy-path test is not
+  over-build; it is the floor.
+- **Do not count `delete:` lines that git already removed.** The net
+  figure is about the diff as proposed, not the diff's own deletions.
+
+## Do NOT
+
+- Do NOT emit a `delete:` finding without all three fence fields — the
+  output contract rejects it.
+- Do NOT invent a finding to avoid an empty report.
+- Do NOT review correctness, security, or performance — other surfaces
+  own those, and a size argument against a guard is the canonical
+  failure this lens is fenced against.
+- Do NOT report a size number as a score. A size metric is a
+  measurement, never a target.

package/dist/agent-src/skills/performance/SKILL.md

@@ -28,6 +28,20 @@ Do NOT use when:
 3. Check for N+1 queries on list endpoints.
 4. Search for existing cache services in the project.
 
+**Performance complexity is a claim, and a claim needs evidence.** No cache
+layer, no denormalised column, no materialised view, no read replica ships on
+"this will be slow" — it ships on a profile, a query log, or a timing that names
+the bottleneck. The added complexity is permanent (invalidation bugs, stale
+reads, a second source of truth); the speedup is hypothetical until measured.
+State the measurement in the change, or do not add the mechanism.
+
+**Carve-out — this does not override the `scale-discipline` floor.** Where that
+pack is installed, R-A2 *mandates* an index on every FK and every WHERE / ORDER
+BY column, and R-A4 governs duplicated data by waiver. Those are structural
+defaults that ship with the query, not optimisations awaiting a profiler; the
+evidence gate above applies to *added mechanisms* (caches, denormalisation,
+replicas, bespoke indexes beyond parity), never to the floor's baseline.
+
 ### Step 1: Apply the right fix
 
 | Bottleneck | Fix |

package/dist/agent-src/skills/pixar-storyteller/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: pixar-storyteller
-description: "Use when turning an idea into a Pixar-style animation prompt — character sheet, scene, image, video — anchored in emotional beat, want, obstacle. Triggers 'Pixar prompt', 'animated scene'."
+description: "Use when an idea becomes a Pixar-style animation prompt — character sheet, scene, image, video; emotional beat, want, obstacle. Triggers 'Pixar prompt', 'animated scene'. Live-action → video-director."
 domain: product
 workspaces:
   - small-business
@@ -119,12 +119,15 @@ Any "no" → revise that block.
 
 ## Policies
 
+Paths, enforcement model, and the full set: the
+[media policy preamble](../../../agents/settings/policies/media/README.md).
+
 The Pixar-storyteller skill anchors prompts to named films and studios by design — the policy surface is the largest in the video cluster:
 
-- [`agents/settings/policies/media/style.md`](../../../agents/settings/policies/media/style.md) — naming a film + year as the *primary* anchor crosses the "in the style of [STUDIO]" trigger; surface and refuse without a transformative-intent rationale.
-- [`agents/settings/policies/media/likeness.md`](../../../agents/settings/policies/media/likeness.md) — when a beat references a named animator's signature character (real-person extension of style).
-- [`agents/settings/policies/media/public-figures.md`](../../../agents/settings/policies/media/public-figures.md) — when the storyteller's character is a recognised public figure rendered in Pixar shape.
-- [`agents/settings/policies/media/disclosure.md`](../../../agents/settings/policies/media/disclosure.md) — every Pixar-style output ships with the AI-generation disclosure; parody / commentary cases are flagged for human review.
+- **`style`** — naming a film + year as the *primary* anchor crosses the "in the style of [STUDIO]" trigger; surface and refuse without a transformative-intent rationale.
+- **`likeness`** — when a beat references a named animator's signature character (real-person extension of style).
+- **`public-figures`** — when the storyteller's character is a recognised public figure rendered in Pixar shape.
+- **`disclosure`** — every Pixar-style output ships with the AI-generation disclosure; parody / commentary cases are flagged for human review.
 
 Refuse-and-surface when style ⇒ primary signature, not one influence among several.
 

package/dist/agent-src/skills/scene-expander/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: scene-expander
-description: "Use when expanding a one-line idea into the 12-block Cinematic Scene Blueprint — provider-agnostic, includes optional dialogue + ambient. Triggers 'expand this scene', 'blueprint for X'."
+description: "Use when expanding a one-line idea into the 12-block Cinematic Scene Blueprint — optional dialogue + ambient. Triggers 'expand this scene', 'blueprint for X'. 11-block refine → video-director."
 personas:
   - hollywood-director
 domain: product
@@ -146,13 +146,16 @@ Any "no" → revise that block.
 
 ## Policies
 
+Paths, enforcement model, and the full set: the
+[media policy preamble](../../../agents/settings/policies/media/README.md).
+
 The 12-block Cinematic Scene Blueprint is the policy choke point — every downstream skill (`motion-choreographer`, `video-director`) inherits whatever the blueprint encodes. Before emitting:
 
-- [`agents/settings/policies/media/likeness.md`](../../../agents/settings/policies/media/likeness.md) — when the SUBJECT block names or visually identifies a real person.
-- [`agents/settings/policies/media/public-figures.md`](../../../agents/settings/policies/media/public-figures.md) — when the SUBJECT block is a recognised public figure.
-- [`agents/settings/policies/media/brand-impersonation.md`](../../../agents/settings/policies/media/brand-impersonation.md) — when STYLE / ENVIRONMENT references a recognised brand's visual identity.
-- [`agents/settings/policies/media/style.md`](../../../agents/settings/policies/media/style.md) — when STYLE anchors to a named living artist or studio as the primary signature.
-- [`agents/settings/policies/media/disclosure.md`](../../../agents/settings/policies/media/disclosure.md) — every distributed blueprint output carries the AI-generation disclosure downstream.
+- **`likeness`** — when the SUBJECT block names or visually identifies a real person.
+- **`public-figures`** — when the SUBJECT block is a recognised public figure.
+- **`brand-impersonation`** — when STYLE / ENVIRONMENT references a recognised brand's visual identity.
+- **`style`** — when STYLE anchors to a named living artist or studio as the primary signature.
+- **`disclosure`** — every distributed blueprint output carries the AI-generation disclosure downstream.
 
 Refuse-and-surface at the blueprint layer; do not push policy questions down to the adapter.
 

package/dist/agent-src/skills/supply-chain-intake/SKILL.md

@@ -32,6 +32,16 @@ PIN IT, LOCK IT, CVE-SCAN IT. NEVER PIPE A REMOTE SCRIPT STRAIGHT TO A SHELL.
 
 ## Procedure — intake gate (run in order before adding a dependency)
 
+0. **Do you need a dependency at all?** The cheapest supply-chain risk is the
+   one never taken. Walk the rungs above "installed dependency" first — is it
+   already in the tree (`npm ls <pkg>`, `composer show`, `pip list`), does the
+   stdlib or framework carry it, does the **platform** already do it
+   (`crypto.randomUUID` before a uuid package, `Intl` before a formatting
+   library, `AbortSignal.timeout` before a timeout helper, the database's own
+   full-text / JSON support before an application-side index)? Full ordering:
+   [`agent-interaction-and-decision-quality` § 8b-ladder](../../../docs/guidelines/agent-infra/agent-interaction-and-decision-quality.md).
+   A dependency added for something already present is permanent cost — install
+   surface, CVE surface, upgrade surface — bought against a capability you had.
 1. **Existence** — confirm the exact string resolves on the real registry, published before your session and with real usage:
    ```bash
    npm view <pkg> version        # non-zero exit = does not exist (hallucination)

package/dist/agent-src/skills/universal-project-analysis/SKILL.md

@@ -31,15 +31,11 @@ Do NOT use when:
 
 ## Mission
 
-Act as the top-level router for deep project investigation.
-
-This skill must:
-
-* confirm whether full-project analysis is justified
-* identify the stack and framework
-* choose the correct analysis mode
-* route to the right specialist analysis skills
-* define the required output for broad project investigations
+Run the deep multi-pass audit itself, and hand each pass to the right
+specialist. Picking *which* skill a request needs in the first place belongs to
+[`analysis-skill-router`](../analysis-skill-router/SKILL.md) — that chooser and
+this orchestrator are deliberately separate files, and the scope test, the
+detection step, and the decision table live there, not here.
 
 This skill must NOT become:
 
@@ -88,9 +84,9 @@ Goal: identify hot paths, find expensive boundaries, route into architecture or
 
 ### 1. Confirm scope
 
-Check whether full-project analysis is really needed.
-Use this skill only if the user wants: broad system understanding, architecture reconstruction, deep multi-layer debugging, broad audit across modules or runtime boundaries.
-If not: route to the narrower specialist skill directly.
+Invoked through the router, this is already settled — proceed. Invoked
+directly, apply the router's scope test before spending a multi-pass audit on
+something a specialist covers.
 
 ### 2. Discover the project
 
@@ -128,36 +124,17 @@ Check:
 * uncertainties are marked
 * conclusions are evidence-based
 
-## Routing map
-
-### Universal analysis skills
-
-* `project-analysis-core`
-* `project-analysis-hypothesis-driven`
-
-### Framework-specific deep dives
-
-* `project-analysis-laravel`
-* `project-analysis-symfony`
-* `project-analysis-zend-laminas`
-* `project-analysis-node-express`
-* `project-analysis-react`
-* `project-analysis-nextjs`
-
-### Optional downstream specialists
-
-* `bug-analyzer`
-* `performance-analysis`
-* `security-audit`
-
-### Ingestion preprocessor
+## Ingestion preprocessor
 
 * `markitdown` — when the project ships PDFs, DOCX, XLSX, PPTX, EPUB,
-  images, or audio that need to feed into any of the analysis skills
-  above. Convert first via the upstream `markitdown-mcp` server, then
+  images, or audio that need to feed into any of the routes in steps 3–4.
+  Convert first via the upstream `markitdown-mcp` server, then
   route the resulting Markdown into the relevant deep-dive skill.
   Never read a binary office format raw.
 
+> The route lists in steps 3 and 4 are the routing map. A second copy of them
+> lived here until 2026-08-02 and was removed — one list, one place.
+
 ## When to add a new framework analysis skill
 
 A framework gets its own `project-analysis-*` skill ONLY if:

package/dist/agent-src/skills/video-director/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: video-director
-description: "Use when turning a scene idea into the 11-block cinematic prompt for live-action AI video — lens, lighting, blocking, motion, negatives. Triggers 'cinematic prompt', 'film-grade scene'."
+description: "Use when a live-action beat becomes the 11-block cinematic prompt — lens, lighting, negatives. Triggers 'cinematic prompt', 'film-grade scene'. Animated → pixar-storyteller; 12-block → scene-expander."
 personas:
   - hollywood-director
 domain: product
@@ -124,13 +124,16 @@ Any "no" → revise that block before handing off.
 
 ## Policies
 
+Paths, enforcement model, and the full set: the
+[media policy preamble](../../../agents/settings/policies/media/README.md).
+
 The 11-block cinematic prompt is live-action shape — real-person and brand-impersonation risks are the highest in the cluster. Before emitting:
 
-- [`agents/settings/policies/media/likeness.md`](../../../agents/settings/policies/media/likeness.md) — when the prompt names or visually identifies a real person on camera.
-- [`agents/settings/policies/media/public-figures.md`](../../../agents/settings/policies/media/public-figures.md) — when the subject is a recognised public figure.
-- [`agents/settings/policies/media/brand-impersonation.md`](../../../agents/settings/policies/media/brand-impersonation.md) — when the prompt copies a journalism / broadcaster / regulated-industry visual identity.
-- [`agents/settings/policies/media/style.md`](../../../agents/settings/policies/media/style.md) — when LIGHT / LENS choices are anchored to a named living cinematographer's signature.
-- [`agents/settings/policies/media/disclosure.md`](../../../agents/settings/policies/media/disclosure.md) — every distributed live-action AI clip carries the non-removable AI-generation disclosure.
+- **`likeness`** — when the prompt names or visually identifies a real person on camera.
+- **`public-figures`** — when the subject is a recognised public figure.
+- **`brand-impersonation`** — when the prompt copies a journalism / broadcaster / regulated-industry visual identity.
+- **`style`** — when LIGHT / LENS choices are anchored to a named living cinematographer's signature.
+- **`disclosure`** — every distributed live-action AI clip carries the non-removable AI-generation disclosure.
 
 Refuse-and-surface at the directorial layer; live-action realism amplifies every policy gap downstream.
 

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "9.12.0"
+agent_config_version: "9.13.0"
 
 # --- Project identity ---
 project: