@event4u/agent-config 9.12.0 → 9.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (130) hide show
  1. package/.claude-plugin/marketplace.json +1 -1
  2. package/CHANGELOG.md +80 -256
  3. package/README.md +1 -1
  4. package/dist/agent-src/rules/active-remediation.md +0 -2
  5. package/dist/agent-src/rules/architecture.md +0 -1
  6. package/dist/agent-src/rules/artifact-drafting-protocol.md +0 -4
  7. package/dist/agent-src/rules/autonomous-execution.md +1 -2
  8. package/dist/agent-src/rules/broken-access-control.md +0 -2
  9. package/dist/agent-src/rules/code-comment-discipline.md +0 -3
  10. package/dist/agent-src/rules/code-provenance.md +0 -3
  11. package/dist/agent-src/rules/communication-through-line.md +2 -3
  12. package/dist/agent-src/rules/content-quoting-floor.md +0 -2
  13. package/dist/agent-src/rules/context-hygiene.md +1 -3
  14. package/dist/agent-src/rules/decision-revisit-gate.md +0 -2
  15. package/dist/agent-src/rules/design-fidelity.md +29 -0
  16. package/dist/agent-src/rules/domain-adoption-policy.md +0 -3
  17. package/dist/agent-src/rules/downstream-changes.md +10 -1
  18. package/dist/agent-src/rules/external-reference-deep-dive.md +0 -7
  19. package/dist/agent-src/rules/fast-path-marker-visibility.md +0 -1
  20. package/dist/agent-src/rules/git-history-discipline.md +0 -7
  21. package/dist/agent-src/rules/guidelines.md +0 -2
  22. package/dist/agent-src/rules/improve-before-implement.md +4 -2
  23. package/dist/agent-src/rules/invite-challenge.md +0 -4
  24. package/dist/agent-src/rules/linked-projects-onboarding-gate.md +0 -2
  25. package/dist/agent-src/rules/markdown-safe-codeblocks.md +0 -1
  26. package/dist/agent-src/rules/minimal-safe-diff.md +2 -2
  27. package/dist/agent-src/rules/missing-tool-handling.md +0 -1
  28. package/dist/agent-src/rules/no-attribution-footers.md +0 -3
  29. package/dist/agent-src/rules/no-decorative-emojis-in-git-surfaces.md +8 -5
  30. package/dist/agent-src/rules/no-pr-progress-comments.md +1 -3
  31. package/dist/agent-src/rules/no-roadmap-references.md +0 -2
  32. package/dist/agent-src/rules/output-discipline.md +0 -1
  33. package/dist/agent-src/rules/prefer-enums-over-literals.md +0 -2
  34. package/dist/agent-src/rules/preservation-guard.md +0 -3
  35. package/dist/agent-src/rules/role-mode-adherence.md +0 -1
  36. package/dist/agent-src/rules/secret-vcs-guard.md +0 -2
  37. package/dist/agent-src/rules/senior-engineering-discipline.md +0 -2
  38. package/dist/agent-src/rules/session-canary.md +0 -2
  39. package/dist/agent-src/rules/size-enforcement.md +0 -5
  40. package/dist/agent-src/rules/source-confidentiality.md +0 -3
  41. package/dist/agent-src/rules/source-discovery-gate.md +0 -2
  42. package/dist/agent-src/rules/think-before-action.md +3 -3
  43. package/dist/agent-src/rules/token-budget-discipline.md +0 -1
  44. package/dist/agent-src/rules/token-efficiency.md +1 -2
  45. package/dist/agent-src/rules/tool-safety.md +0 -1
  46. package/dist/agent-src/rules/user-interaction.md +0 -3
  47. package/dist/agent-src/rules/user-interrupt-priority.md +0 -1
  48. package/dist/agent-src/skills/agent-docs-writing/SKILL.md +8 -0
  49. package/dist/agent-src/skills/analysis-skill-router/SKILL.md +55 -86
  50. package/dist/agent-src/skills/character-consistency/SKILL.md +7 -4
  51. package/dist/agent-src/skills/decision-record/SKILL.md +8 -0
  52. package/dist/agent-src/skills/design-review/SKILL.md +11 -0
  53. package/dist/agent-src/skills/design-system-capture/reference/design-system-json.md +8 -0
  54. package/dist/agent-src/skills/existing-ui-audit/SKILL.md +34 -3
  55. package/dist/agent-src/skills/fe-design/SKILL.md +10 -0
  56. package/dist/agent-src/skills/motion-choreographer/SKILL.md +7 -4
  57. package/dist/agent-src/skills/overbuild-review-lens/SKILL.md +201 -0
  58. package/dist/agent-src/skills/performance/SKILL.md +14 -0
  59. package/dist/agent-src/skills/pixar-storyteller/SKILL.md +8 -5
  60. package/dist/agent-src/skills/scene-expander/SKILL.md +9 -6
  61. package/dist/agent-src/skills/supply-chain-intake/SKILL.md +10 -0
  62. package/dist/agent-src/skills/universal-project-analysis/SKILL.md +14 -37
  63. package/dist/agent-src/skills/video-director/SKILL.md +9 -6
  64. package/dist/agent-src/templates/agents/agent-project-settings.example.yml +1 -1
  65. package/dist/agent-src/templates/scripts/work_engine/directives/ui/apply.ts +154 -13
  66. package/dist/agent-src/templates/scripts/work_engine/directives/ui/design.ts +118 -0
  67. package/dist/agent-src/templates/scripts/work_engine/directives/ui/polish.ts +40 -0
  68. package/dist/agent-src/templates/scripts/work_engine/state.ts +55 -0
  69. package/dist/discovery/deprecation-report.md +1 -1
  70. package/dist/discovery/discovery-manifest.json +89 -67
  71. package/dist/discovery/discovery-manifest.json.sha256 +1 -1
  72. package/dist/discovery/discovery-manifest.summary.md +3 -3
  73. package/dist/discovery/orphan-report.md +1 -1
  74. package/dist/discovery/packs.json +6 -5
  75. package/dist/discovery/trust-report.md +2 -2
  76. package/dist/discovery/workspaces.json +5 -4
  77. package/dist/hooks/dispatch.js +174 -13
  78. package/dist/mcp/registry-manifest.json +3 -3
  79. package/dist/mcp/server.json +2 -2
  80. package/dist/mcp/server.mjs +750 -507
  81. package/dist/router.json +1 -1
  82. package/dist/scripts/condense.js +2 -2
  83. package/docs/MIGRATION.md +1 -1
  84. package/docs/guidelines/agent-infra/agent-interaction-and-decision-quality.md +71 -0
  85. package/docs/guidelines/agent-infra/minimal-safe-diff-mechanics.md +24 -1
  86. package/docs/guidelines/code-clarity.md +9 -2
  87. package/docs/guidelines/design-fidelity-mechanics.md +44 -0
  88. package/llms.txt +63 -27
  89. package/package.json +4 -4
  90. package/src/agent-src/templates/scripts/work_engine/directives/ui/apply.ts +154 -13
  91. package/src/agent-src/templates/scripts/work_engine/directives/ui/design.ts +118 -0
  92. package/src/agent-src/templates/scripts/work_engine/directives/ui/polish.ts +40 -0
  93. package/src/agent-src/templates/scripts/work_engine/state.ts +55 -0
  94. package/src/config/agent-settings.template.yml +8 -0
  95. package/src/scripts/_lib/counted_probe.ts +142 -0
  96. package/src/scripts/_lib/overbuild_lens_contract.ts +196 -0
  97. package/src/scripts/_lib/release_scope.ts +207 -0
  98. package/src/scripts/ai_council/stance_tally.ts +37 -2
  99. package/src/scripts/audit_auto_rules.ts +9 -9
  100. package/src/scripts/audit_likelihood.ts +3 -3
  101. package/src/scripts/audit_overlap.ts +2 -2
  102. package/src/scripts/audit_skill_overlap.ts +233 -95
  103. package/src/scripts/audit_skill_overlap_allowlist.json +4 -0
  104. package/src/scripts/build_proof.ts +15 -1
  105. package/src/scripts/check_dependency_floors.ts +16 -6
  106. package/src/scripts/check_gate_coverage.ts +6 -6
  107. package/src/scripts/check_kernel_rule_bundle.ts +5 -4
  108. package/src/scripts/check_token_quality_golden.ts +0 -18
  109. package/src/scripts/code_graph/loader.ts +35 -6
  110. package/src/scripts/compile_router.ts +3 -8
  111. package/src/scripts/condense.ts +2 -2
  112. package/src/scripts/explain_run.ts +0 -1
  113. package/src/scripts/generate_pack_manifests.ts +3 -20
  114. package/src/scripts/hooks/block_kernel_rule_writes.ts +145 -10
  115. package/src/scripts/hooks/block_no_verify.ts +101 -0
  116. package/src/scripts/lint_agent_security.ts +5 -4
  117. package/src/scripts/lint_framework_leakage_allowlist.json +2 -2
  118. package/src/scripts/lint_regression.ts +92 -1
  119. package/src/scripts/lint_skill_descriptions.ts +93 -5
  120. package/src/scripts/project_thin_rules.ts +2 -2
  121. package/src/scripts/release.ts +107 -3
  122. package/src/scripts/resolve_lint_scope.ts +53 -0
  123. package/src/scripts/router_telemetry.ts +0 -5
  124. package/src/scripts/runtime_dispatcher.ts +40 -0
  125. package/src/scripts/schemas/pack.schema.json +1 -5
  126. package/src/scripts/schemas/rule.schema.json +1 -2
  127. package/src/scripts/self_review_gate.ts +15 -73
  128. package/src/scripts/skill_linter.ts +93 -11
  129. package/src/scripts/sweep_dead_scan_roots.ts +550 -0
  130. package/src/scripts/trigger_coverage.ts +11 -37
@@ -17,7 +17,7 @@ import {
17
17
  StepResult,
18
18
  agent_directive,
19
19
  } from '../../delivery_state.js';
20
- import { placeholder_paths } from './design.js';
20
+ import { has_design_system, placeholder_paths, provided_artifact } from './design.js';
21
21
  import {
22
22
  is_ambiguous_stack,
23
23
  bundle_line,
@@ -51,6 +51,17 @@ export const AMBIGUITIES: ReadonlyArray<Record<string, string>> = [
51
51
  'agent directive `ui-apply-<stack>` → skill ' +
52
52
  'bundle implements the brief and writes the envelope back',
53
53
  },
54
+ {
55
+ code: 'apply_coverage_missing',
56
+ trigger:
57
+ 'a provided artifact is in state.ui_design but the ui_apply ' +
58
+ 'envelope carries no coverage report, or the report leaves a ' +
59
+ 'declared interaction / keyframe / asset unaccounted for',
60
+ resolution:
61
+ 'agent writes ui_apply.coverage = {honoured: [], translated: [], ' +
62
+ 'flagged: []} naming every declared item exactly once — a dropped ' +
63
+ 'handler belongs in `flagged`, never in silence',
64
+ },
54
65
  {
55
66
  code: 'apply_placeholders_in_output',
56
67
  trigger:
@@ -89,10 +100,122 @@ export function run(state: DeliveryState): StepResult {
89
100
  return _halt_placeholders(state, violations);
90
101
  }
91
102
 
103
+ const provided = provided_artifact(state.ui_design as Record<string, Any> | null);
104
+ if (provided !== null) {
105
+ const gaps = coverage_gaps(provided, envelope['coverage']);
106
+ if (gaps.length > 0) {
107
+ return _halt_coverage(state, provided, gaps);
108
+ }
109
+ }
110
+
92
111
  _record_changes(state, envelope);
93
112
  return new StepResult({ outcome: Outcome.SUCCESS });
94
113
  }
95
114
 
115
+ /** Buckets the coverage report must sort every declared item into. */
116
+ export const COVERAGE_BUCKETS: ReadonlyArray<string> = ['honoured', 'translated', 'flagged'];
117
+
118
+ /** Declared-item lists a port has to account for, in report order. */
119
+ export const COVERED_INVENTORIES: ReadonlyArray<string> = [
120
+ 'interactions',
121
+ 'keyframes',
122
+ 'assets',
123
+ ];
124
+
125
+ /**
126
+ * Return every reason the coverage report fails to account for the artifact.
127
+ *
128
+ * The fidelity ledger the port case never had. `apply` used to validate its
129
+ * output with a single placeholder substring scan and nothing else, so a
130
+ * dropped handler or a lost keyframe left no trace anywhere — the loss was
131
+ * structurally silent, not merely unreported. Requiring each declared item to
132
+ * appear in exactly one bucket turns that silence into a halt: a handler the
133
+ * port could not carry has to be written down in `flagged`.
134
+ *
135
+ * Matching is substring containment against the bucket entries, so an entry
136
+ * may carry its own explanation ("submit handler — translated to a form
137
+ * action") and still count as accounting for `submit handler`.
138
+ */
139
+ export function coverage_gaps(
140
+ provided: Record<string, Any>,
141
+ coverage: Any,
142
+ ): string[] {
143
+ const gaps: string[] = [];
144
+ if (!_isDict(coverage)) {
145
+ return [
146
+ 'no `coverage` report in the apply envelope — a provided artifact ' +
147
+ 'requires one',
148
+ ];
149
+ }
150
+ const entries: string[] = [];
151
+ for (const bucket of COVERAGE_BUCKETS) {
152
+ const value = coverage[bucket];
153
+ if (value === undefined) {
154
+ gaps.push(`\`coverage.${bucket}\` is missing (use an empty list if nothing qualifies)`);
155
+ continue;
156
+ }
157
+ if (!Array.isArray(value)) {
158
+ gaps.push(`\`coverage.${bucket}\` must be a list of strings`);
159
+ continue;
160
+ }
161
+ for (const item of value) {
162
+ if (typeof item === 'string' && item !== '') {
163
+ entries.push(item.toLowerCase());
164
+ }
165
+ }
166
+ }
167
+ for (const inventory of COVERED_INVENTORIES) {
168
+ const declared = provided[inventory];
169
+ if (!Array.isArray(declared)) continue;
170
+ for (const item of declared) {
171
+ if (typeof item !== 'string' || item === '') continue;
172
+ const needle = item.toLowerCase();
173
+ if (!entries.some((entry) => entry.includes(needle))) {
174
+ gaps.push(
175
+ `\`${inventory}\`: \`${item}\` appears in no coverage bucket`,
176
+ );
177
+ }
178
+ }
179
+ }
180
+ return gaps;
181
+ }
182
+
183
+ /** BLOCKED halt — the port did not account for what the artifact declared. */
184
+ function _halt_coverage(
185
+ state: DeliveryState,
186
+ provided: Record<string, Any>,
187
+ gaps: string[],
188
+ ): StepResult {
189
+ const directive = _resolve_directive(state);
190
+ const contract = has_design_system(provided)
191
+ ? 'A `design-system.json` came with this artifact, so its token values ' +
192
+ 'are honoured verbatim — say which, and which you had to translate.'
193
+ : 'No `design-system.json` came with this artifact, so every token ' +
194
+ 'value you did not read from it belongs in `translated` or `flagged`.';
195
+ const lines: string[] = [
196
+ agent_directive(directive),
197
+ '> Apply rejected: this is a port of a provided artifact, and the ' +
198
+ 'coverage report does not account for it.',
199
+ `> ${contract}`,
200
+ '> Unaccounted:',
201
+ ];
202
+ for (const gap of gaps) {
203
+ lines.push(`> - ${gap}`);
204
+ }
205
+ lines.push(
206
+ '> Write `ui_apply.coverage = {honoured: [...], translated: [...], ' +
207
+ 'flagged: [...]}` naming every declared interaction, keyframe, and ' +
208
+ 'asset exactly once. A handler the port could not carry goes in ' +
209
+ '`flagged` with the reason — never in silence.',
210
+ );
211
+ return new StepResult({
212
+ outcome: Outcome.BLOCKED,
213
+ questions: lines,
214
+ message:
215
+ `UI apply rejected: ${gaps.length} coverage gap(s) against the provided artifact.`,
216
+ });
217
+ }
218
+
96
219
  /** Return the agent-written `ui_apply` envelope, or `null`. */
97
220
  function _apply_envelope(state: DeliveryState): Record<string, Any> | null {
98
221
  const data = _pyTruthy(state.ticket) ? state.ticket : {};
@@ -143,20 +266,38 @@ function _delegate_to_stack_skill(state: DeliveryState): StepResult {
143
266
  'the open question is which project to build for.',
144
267
  });
145
268
  }
269
+ const provided = provided_artifact(state.ui_design as Record<string, Any> | null);
270
+ const lines: string[] = [
271
+ agent_directive(directive),
272
+ `> Stack: \`${stack_label}\`. Implementing the locked design brief.`,
273
+ bundle_line(state.stack, 'build', stack_label),
274
+ '> Microcopy is locked — every button label, empty-state ' +
275
+ 'message, and validation message must come verbatim from ' +
276
+ '`state.ui_design.microcopy`.',
277
+ ];
278
+ if (provided !== null) {
279
+ lines.push(
280
+ '> This is a **port**: `state.ui_design.provided_artifact` is the ' +
281
+ 'spec. Build it 1:1' +
282
+ (has_design_system(provided)
283
+ ? ', and read token values from its `design_system` rather ' +
284
+ 'than re-deriving them.'
285
+ : '; no `design_system` came with it, so anything you cannot ' +
286
+ 'read from the artifact is a translation you have to name.'),
287
+ '> The envelope must carry `coverage: {honoured, translated, ' +
288
+ 'flagged}` accounting for every declared interaction, keyframe, ' +
289
+ 'and asset exactly once — apply rejects the envelope otherwise.',
290
+ );
291
+ }
292
+ lines.push(
293
+ '> 1. Continue — implement the brief and write a ' +
294
+ '`ui_apply` envelope back into state.ticket ' +
295
+ '(rendered: {path: text}, files: [...])',
296
+ '> 2. Abort — drop this UI request',
297
+ );
146
298
  return new StepResult({
147
299
  outcome: Outcome.BLOCKED,
148
- questions: [
149
- agent_directive(directive),
150
- `> Stack: \`${stack_label}\`. Implementing the locked design brief.`,
151
- bundle_line(state.stack, 'build', stack_label),
152
- '> Microcopy is locked — every button label, empty-state ' +
153
- 'message, and validation message must come verbatim from ' +
154
- '`state.ui_design.microcopy`.',
155
- '> 1. Continue — implement the brief and write a ' +
156
- '`ui_apply` envelope back into state.ticket ' +
157
- '(rendered: {path: text}, files: [...])',
158
- '> 2. Abort — drop this UI request',
159
- ],
300
+ questions: lines,
160
301
  message: `UI apply pending; delegating to \`${directive}\` for stack \`${stack_label}\`.`,
161
302
  });
162
303
  }
@@ -44,6 +44,33 @@ export const PLACEHOLDER_PATTERNS: ReadonlyArray<string> = [
44
44
  'xxx',
45
45
  ];
46
46
 
47
+ /**
48
+ * Optional brief key carrying a user-supplied design artifact.
49
+ *
50
+ * The brief's five required keys are a lossy projection of a finished
51
+ * artifact: `layout` is prose, not a spacing scale, and there is no slot at
52
+ * all for easing, hover behaviour, handlers, or assets. Before this key the
53
+ * pipeline had no channel for a handed-over design, so it rebuilt one from
54
+ * the five-key abstraction and said nothing about the difference. This slot
55
+ * is that channel — one more input to the same step, never a parallel track.
56
+ */
57
+ export const PROVIDED_ARTIFACT_KEY = 'provided_artifact';
58
+
59
+ /**
60
+ * What the five-key brief cannot carry from a provided artifact.
61
+ *
62
+ * Stated to the user **before** any regeneration, not discovered afterwards.
63
+ * A supplied `design-system.json` closes the first two; the rest are closed
64
+ * only by the coverage report `apply` demands.
65
+ */
66
+ export const UNCARRIED_BY_THE_BRIEF: ReadonlyArray<string> = [
67
+ 'exact spacing values — `layout` is prose, not a scale',
68
+ 'easing curves and animation timing',
69
+ 'hover / focus / active behaviour',
70
+ 'event handlers and the interactions they drive',
71
+ 'the asset manifest (images, icons, fonts the artifact references)',
72
+ ];
73
+
47
74
  export const AMBIGUITIES: ReadonlyArray<Record<string, string>> = [
48
75
  {
49
76
  code: 'design_missing',
@@ -61,6 +88,17 @@ export const AMBIGUITIES: ReadonlyArray<Record<string, string>> = [
61
88
  'agent re-runs the brief with final strings; ' +
62
89
  'halt lists the offending microcopy keys',
63
90
  },
91
+ {
92
+ code: 'design_provided_without_contract',
93
+ trigger:
94
+ 'state.ui_design.provided_artifact is set but carries no ' +
95
+ 'design_system, and the loss has not been acknowledged — the ' +
96
+ 'brief would silently regenerate what it cannot carry',
97
+ resolution:
98
+ 'user supplies a design-system.json (honoured verbatim), or ' +
99
+ 'acknowledges the named losses so the port proceeds with them ' +
100
+ 'stated up front',
101
+ },
64
102
  {
65
103
  code: 'design_unconfirmed',
66
104
  trigger: 'brief is well-formed but design_confirmed is unset/False',
@@ -123,6 +161,11 @@ export function run(state: DeliveryState): StepResult {
123
161
  return _halt_placeholders(state, placeholders);
124
162
  }
125
163
 
164
+ const provided = provided_artifact(designDict);
165
+ if (provided !== null && !_contract_or_loss_acknowledged(provided)) {
166
+ return _halt_provided_without_contract(state, provided);
167
+ }
168
+
126
169
  if (designDict['design_confirmed'] === true) {
127
170
  return new StepResult({ outcome: Outcome.SUCCESS });
128
171
  }
@@ -238,6 +281,81 @@ function _walk_placeholders(node: Any, prefix: string, violations: string[]): vo
238
281
  }
239
282
  }
240
283
 
284
+ /**
285
+ * Return the supplied-artifact envelope, or `null` when none was handed over.
286
+ *
287
+ * Exported because `apply` needs the same answer — the coverage report it
288
+ * demands exists only for a port, and a second copy of "is this a port?"
289
+ * would be the drift this package has paid for before (see the shared
290
+ * `placeholder_paths` walker above).
291
+ */
292
+ export function provided_artifact(
293
+ design: Record<string, Any> | null | undefined,
294
+ ): Record<string, Any> | null {
295
+ if (!_isDict(design)) return null;
296
+ const provided = design[PROVIDED_ARTIFACT_KEY];
297
+ if (!_isDict(provided) || Object.keys(provided).length === 0) return null;
298
+ return provided;
299
+ }
300
+
301
+ /** True when a machine-readable contract came with the artifact. */
302
+ export function has_design_system(provided: Record<string, Any>): boolean {
303
+ return _isDict(provided['design_system']) && _pyTruthy(provided['design_system']);
304
+ }
305
+
306
+ /** The port may proceed: either a contract exists, or the losses were stated and accepted. */
307
+ function _contract_or_loss_acknowledged(provided: Record<string, Any>): boolean {
308
+ return has_design_system(provided) || provided['loss_acknowledged'] === true;
309
+ }
310
+
311
+ /**
312
+ * BLOCKED halt — an artifact was handed over with no contract behind it.
313
+ *
314
+ * This is the honest-refusal branch. The pipeline *can* rebuild the artifact
315
+ * from the five-key brief; what it must not do is rebuild it silently. The
316
+ * halt names every value the brief cannot carry, then asks. Answering
317
+ * option 1 sets `loss_acknowledged` and the same losses are on the record.
318
+ */
319
+ function _halt_provided_without_contract(
320
+ state: DeliveryState,
321
+ provided: Record<string, Any>,
322
+ ): StepResult {
323
+ const preview = _preview_input(state);
324
+ const ref = typeof provided['path'] === 'string' && provided['path'] !== ''
325
+ ? String(provided['path'])
326
+ : 'the provided artifact';
327
+ const lines: string[] = [
328
+ `> Input: ${preview}`,
329
+ `> \`${ref}\` is a finished design handed over as the spec, and no ` +
330
+ '`design-system.json` came with it. The design brief carries five ' +
331
+ 'keys (layout, components, states, microcopy, a11y) — everything ' +
332
+ 'below is outside them and would be rebuilt from taste rather than ' +
333
+ 'read from your artifact:',
334
+ ];
335
+ for (const loss of UNCARRIED_BY_THE_BRIEF) {
336
+ lines.push(`> - ${loss}`);
337
+ }
338
+ lines.push(
339
+ '> 1. Proceed — port it with those five losses on the record; `apply` ' +
340
+ 'still has to report what it honoured, translated, and flagged',
341
+ '> 2. Supply a `design-system.json` — its token values are then ' +
342
+ 'honoured verbatim instead of re-derived',
343
+ '> 3. Abort — drop this UI request',
344
+ '',
345
+ '**Recommendation: 2 — Supply the contract** — it is the only option ' +
346
+ 'that closes the spacing and easing losses at the source. Caveat: ' +
347
+ 'pick 1 when no extractor is available; the port then proceeds with ' +
348
+ 'the gap stated rather than hidden.',
349
+ );
350
+ return new StepResult({
351
+ outcome: Outcome.BLOCKED,
352
+ questions: lines,
353
+ message:
354
+ 'UI design halted: a provided artifact carries no design-system.json; ' +
355
+ `${UNCARRIED_BY_THE_BRIEF.length} value class(es) cannot be carried by the brief.`,
356
+ });
357
+ }
358
+
241
359
  /** Render a one-line preview of the input being designed. */
242
360
  function _preview_input(state: DeliveryState): string {
243
361
  const data = (_isDict(state.ticket) ? state.ticket : {}) as Record<string, Any>;
@@ -116,6 +116,41 @@ function _pyTruthy(value: Any): boolean {
116
116
  return true;
117
117
  }
118
118
 
119
+ /**
120
+ * Findings the provided artifact already answers — informational, never
121
+ * fix-worthy.
122
+ *
123
+ * A port carries its source's aesthetic on purpose. Left unfiltered, a
124
+ * finding like "cream palette reads as scaffold-default" is indistinguishable
125
+ * from a real defect, so the polish loop spends a round editing the port away
126
+ * from the spec the user approved — the exact regression `daf-slop-vs-provided`
127
+ * witnesses. Marking the finding rather than deleting it keeps it visible in
128
+ * the review output; what changes is that it no longer drives a round.
129
+ *
130
+ * Scope is strict, and the burden sits with the marker: only a decision the
131
+ * artifact **actually covers** may carry the flag. Generative work in the same
132
+ * run is not artifact-covered and stays fully subject to the anti-slop scan.
133
+ */
134
+ export const ARTIFACT_COVERED_KEY = 'artifact_covered';
135
+
136
+ /** True when this finding is answered by the provided artifact. */
137
+ function _is_artifact_covered(finding: Any): boolean {
138
+ return _isDict(finding) && finding[ARTIFACT_COVERED_KEY] === true;
139
+ }
140
+
141
+ /** Split findings into the ones that drive rounds and the informational rest. */
142
+ export function partition_artifact_covered(findings: ReadonlyArray<Any>): {
143
+ actionable: Any[];
144
+ informational: Any[];
145
+ } {
146
+ const actionable: Any[] = [];
147
+ const informational: Any[] = [];
148
+ for (const finding of findings) {
149
+ (_is_artifact_covered(finding) ? informational : actionable).push(finding);
150
+ }
151
+ return { actionable, informational };
152
+ }
153
+
119
154
  /** Apply the polish-loop gate. */
120
155
  export function run(state: DeliveryState): StepResult {
121
156
  const review = _pyTruthy(state.ui_review) ? (state.ui_review as Record<string, Any>) : {};
@@ -125,6 +160,11 @@ export function run(state: DeliveryState): StepResult {
125
160
  }
126
161
  const review_clean = _pyTruthy(review['review_clean']);
127
162
 
163
+ // Artifact-covered findings are dropped from the round-driving set before
164
+ // anything else reads it — including the ceiling check, so a port cannot
165
+ // burn its two rounds on findings it was never allowed to act on.
166
+ findings = partition_artifact_covered(findings as Any[]).actionable;
167
+
128
168
  if (review_clean || (findings as Any[]).length === 0) {
129
169
  return new StepResult({ outcome: Outcome.SUCCESS });
130
170
  }
@@ -669,6 +669,61 @@ function _validate_ui_design(ui_design: JsonValue): void {
669
669
  `required state) or null; got ${pyTypeName(ui_design['states'])}`,
670
670
  );
671
671
  }
672
+ _validate_provided_artifact(ui_design['provided_artifact']);
673
+ }
674
+
675
+ /**
676
+ * Reject a malformed `ui_design.provided_artifact` envelope; tolerate absence.
677
+ *
678
+ * The slot is the port case's only carrier, and both gates that consume it
679
+ * (`design`'s honest-refusal halt, `apply`'s coverage ledger) branch on its
680
+ * shape. Shape-checking here rather than in the handlers means a `interactions:
681
+ * "three"` cannot quietly reduce the coverage ledger to zero declared items —
682
+ * the same bypass-by-type that `states: "n/a"` used to achieve against the
683
+ * five-state loop.
684
+ */
685
+ function _validate_provided_artifact(provided: JsonValue | undefined): void {
686
+ if (provided === undefined || provided === null) {
687
+ return;
688
+ }
689
+ if (!_isDict(provided)) {
690
+ throw new SchemaError(
691
+ 'state.ui_design.provided_artifact must be a JSON object or null; ' +
692
+ `got ${pyTypeName(provided)}`,
693
+ );
694
+ }
695
+ if ('path' in provided && typeof provided['path'] !== 'string') {
696
+ throw new SchemaError(
697
+ 'state.ui_design.provided_artifact.path must be a string when present',
698
+ );
699
+ }
700
+ if (
701
+ 'design_system' in provided &&
702
+ provided['design_system'] !== null &&
703
+ !_isDict(provided['design_system'])
704
+ ) {
705
+ throw new SchemaError(
706
+ 'state.ui_design.provided_artifact.design_system must be a JSON ' +
707
+ `object or null; got ${pyTypeName(provided['design_system'])}`,
708
+ );
709
+ }
710
+ if (
711
+ 'loss_acknowledged' in provided &&
712
+ typeof provided['loss_acknowledged'] !== 'boolean'
713
+ ) {
714
+ throw new SchemaError(
715
+ 'state.ui_design.provided_artifact.loss_acknowledged must be a ' +
716
+ 'boolean when present',
717
+ );
718
+ }
719
+ for (const key of ['interactions', 'keyframes', 'assets']) {
720
+ if (key in provided && !Array.isArray(provided[key])) {
721
+ throw new SchemaError(
722
+ `state.ui_design.provided_artifact.${key} must be a list of ` +
723
+ `strings when present; got ${pyTypeName(provided[key])}`,
724
+ );
725
+ }
726
+ }
672
727
  }
673
728
 
674
729
  /**
@@ -1,6 +1,6 @@
1
1
  # Discovery — Deprecation Report
2
2
 
3
- - Generated: `2026-08-01T06:24:46Z`
3
+ - Generated: `2026-08-02T08:46:05Z`
4
4
  - Deprecated artefacts: **0**
5
5
 
6
6
  _None. Tree is clean._