@event4u/agent-config 9.12.0 → 9.14.0

package/src/scripts/release.ts

@@ -357,6 +357,109 @@ const SECTIONS: ReadonlyArray<readonly [string, string | null, readonly string[]
     ['Chores', null, ['chore']],
 ];
 
+// ---------------------------------------------------------------------------
+// Curated head (road-to-release-shape-honesty Phase 2)
+// ---------------------------------------------------------------------------
+
+/**
+ * The five head lines, in the order an operator reads them.
+ *
+ * Reviewers of 9.9.0 and 9.10.0 repeatedly could not tell, from a generated
+ * commit log, which entries change consumer behaviour, which need migration,
+ * which are internal gate repairs, and which ended as nulls. The log is a
+ * faithful record of *what was committed*; it is not a statement of *what
+ * changed for you*. The head is that statement, and it sits above the log
+ * rather than replacing it.
+ *
+ * Wording is taken from `docs/RELEASE_STORY_TEMPLATE.md` rather than invented,
+ * so the package does not end up with two competing definitions of a curated
+ * head.
+ */
+const RELEASE_HEAD_SECTIONS: ReadonlyArray<string> = [
+    'Behaviour changes',
+    'Default changes + migration',
+    'Security and correctness',
+    'Honest nulls',
+    'Known limitations',
+];
+
+/**
+ * Cap on the head, in rendered lines.
+ *
+ * Roughly ten operator-relevant lines: past that it stops being a summary and
+ * becomes a second changelog. The era budget is also finite
+ * (`_lib/changelog_eras.ts`, 250 lines per era), so an unbounded head would
+ * quietly consume it.
+ */
+export const RELEASE_HEAD_CAP_LINES = 10;
+
+/**
+ * The default value of every head line.
+ *
+ * `_none_` and not a placeholder token: for most releases it is the **true**
+ * answer, and a release that genuinely changed no defaults should say so
+ * rather than carry an unfilled marker. That also keeps the skeleton free of
+ * the placeholder prose `output-discipline` bans — there is nothing here that
+ * is wrong-if-shipped, only something that is uninformative-if-unedited.
+ */
+const HEAD_DEFAULT = '_none_';
+
+/**
+ * Render the curated head. Emitted by the generator on every release so it
+ * cannot be forgotten; edited by the maintainer before merge.
+ */
+export function render_release_head(
+    filled: Readonly<Record<string, string>> = {},
+): string[] {
+    const lines: string[] = [
+        '### Release highlights',
+        '',
+        '<!-- Curated head: fill before merge, keep it under ' +
+            `${RELEASE_HEAD_CAP_LINES} lines, and leave \`${HEAD_DEFAULT}\` where it is ` +
+            'genuinely the answer. The generated log below is unchanged. -->',
+    ];
+    for (const label of RELEASE_HEAD_SECTIONS) {
+        const value = (filled[label] ?? '').trim();
+        lines.push(`- **${label}:** ${value === '' ? HEAD_DEFAULT : value}`);
+    }
+    return lines;
+}
+
+/**
+ * Drop commits whose rendered line would be identical.
+ *
+ * The generated log is keyed by SHA, but a reader is not: a cherry-pick, a
+ * re-land, or one change split across branches produces the same
+ * `scope: subject` twice with different SHAs, and the notes then say the same
+ * thing twice with two links. Keyed on `type + scope + subject` — the parts
+ * that reach the rendered line — keeping the first occurrence, so the earliest
+ * SHA stays the citation.
+ *
+ * Breaking commits are never folded into a non-breaking twin: `!` changes what
+ * the line *means*, and collapsing them would hide a breaking change behind a
+ * routine one.
+ */
+export function dedupe_commit_lines(commits: readonly Commit[]): Commit[] {
+    const seen = new Set<string>();
+    const out: Commit[] = [];
+    for (const c of commits) {
+        const key = [c.breaking ? '!' : '', c.type, c.scope ?? '', c.subject].join('\x1f');
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        out.push(c);
+    }
+    return out;
+}
+
+/** Rendered length of the head, for the cap assertion. */
+export function release_head_line_count(head: readonly string[]): number {
+    // The HTML comment is invisible to a reader, so it does not count against
+    // an operator-facing cap.
+    return head.filter((l) => !l.trimStart().startsWith('<!--')).length;
+}
+
 const BREAKING_RE = /^([a-z]+)(\([^)]+\))?!:/;
 const CONVENTIONAL_RE = /^(?<type>[a-z]+)(?:\((?<scope>[^)]+)\))?(?<bang>!)?: (?<subject>.+)$/;
 
@@ -687,7 +790,7 @@ function render_changelog_entry(
     prev: string | null,
     commits: readonly Commit[],
     today: string,
-    opts: { test_trend_line?: string | null } = {},
+    opts: { test_trend_line?: string | null; head?: Readonly<Record<string, string>> } = {},
 ): [string, string] {
     const test_trend_line = opts.test_trend_line ?? null;
     let heading: string;
@@ -706,7 +809,7 @@ function render_changelog_entry(
     }
     grouped['BREAKING CHANGES'] = [];
     const other: Commit[] = [];
-    for (const c of commits) {
+    for (const c of dedupe_commit_lines(commits)) {
         if (c.breaking) {
             grouped['BREAKING CHANGES']!.push(c);
             continue;
@@ -724,7 +827,8 @@ function render_changelog_entry(
         }
     }
 
-    const body_lines: string[] = [];
+    // The curated head sits above the generated log, which stays unchanged.
+    const body_lines: string[] = [...render_release_head(opts.head ?? {})];
     const ordered_labels = ['BREAKING CHANGES', ...SECTIONS.map(([label]) => label)];
     for (const label of ordered_labels) {
         const bucket = grouped[label] ?? [];

package/src/scripts/resolve_lint_scope.ts

@@ -0,0 +1,53 @@
+#!/usr/bin/env tsx
+/**
+ * Print the diff base a content check should compare HEAD against.
+ *
+ * A resolver, not a gate — it decides nothing and blocks nothing. It exists so
+ * the shell-side checks in `.github/workflows/skill-lint.yml` resolve their
+ * scope from the same source as `skill_linter --changed`, instead of hardcoding
+ * `origin/${base_ref}` and going blind on a release PR (the "0 changed corpus
+ * files, INCONCLUSIVE" outcome).
+ *
+ * Usage:
+ *   resolve_lint_scope [--base-ref <ref>] [--json]
+ *
+ * Prints the base ref on stdout and the reason on stderr, so a caller can do
+ *   BASE="$(./scripts-run src/scripts/resolve_lint_scope --base-ref "origin/$X")"
+ * and still see the explanation in the log.
+ *
+ * Exit codes: 0 always — a resolver that cannot widen reports the ordinary
+ * base and says why. Failing here would turn an unresolvable tag into a red
+ * release for the wrong reason; the emptiness decision belongs to the gate.
+ */
+import { resolveContentLintScope } from './_lib/release_scope.js';
+
+export function main(argv: string[]): number {
+    let baseRef: string | undefined;
+    let asJson = false;
+    for (let i = 0; i < argv.length; i += 1) {
+        const a = argv[i] as string;
+        if (a === '--base-ref') {
+            baseRef = argv[i + 1];
+            i += 1;
+        } else if (a.startsWith('--base-ref=')) {
+            baseRef = a.slice('--base-ref='.length);
+        } else if (a === '--json') {
+            asJson = true;
+        }
+    }
+
+    const scope = resolveContentLintScope(baseRef === undefined ? {} : { baseRef });
+    if (asJson) {
+        process.stdout.write(`${JSON.stringify(scope)}\n`);
+        return 0;
+    }
+    process.stderr.write(`resolve_lint_scope: ${scope.reason}\n`);
+    process.stdout.write(`${scope.base}\n`);
+    return 0;
+}
+
+const invokedDirectly =
+    process.argv[1] !== undefined && /resolve_lint_scope\.ts$/.test(process.argv[1]);
+if (invokedDirectly) {
+    process.exit(main(process.argv.slice(2)));
+}

package/src/scripts/router_telemetry.ts

@@ -24,7 +24,6 @@
  *   | `keyword`      | case-insensitive substring inside the prompt text                |
  *   | `phrase`       | case-insensitive substring (multi-word) inside the prompt text   |
  *   | `command`      | case-sensitive prefix on `command:` field (optional context)     |
- *   | `intent`       | informational only — never auto-matches; counted separately      |
  *   | `path_prefix`  | prefix match against any path in `open_files` (optional context) |
  *   | `file_pattern` | fnmatch against any path in `open_files` (optional context)      |
  *
@@ -227,10 +226,6 @@ export function trigger_matches(
     }
     return false;
   }
-  if ("intent" in trigger) {
-    // Intent triggers are informational and never auto-match.
-    return false;
-  }
   return false;
 }
 

package/src/scripts/runtime_dispatcher.ts

@@ -34,6 +34,7 @@ import { build_registry } from './runtime_registry.js';
 import type { ExecutionResult} from './runtime_handler.js';
 import { HandlerError, execute_shell } from './runtime_handler.js';
 import { resolve_level } from './_lib/script_output.js';
+import { validate_tool_declarations } from './tool_registry.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 
@@ -187,6 +188,45 @@ export function dispatch(skillName: string, registry: SkillRuntime[]): DispatchR
                 warnings: [],
             });
         }
+        // Gate integrity — the grant resolves against TRUSTED config, never
+        // against the skill's own frontmatter.
+        //
+        // road-to-governance-invariants Phase 4, property (b). Every field the
+        // three checks above read (`execution_type`, `handler`, `safety_mode`)
+        // comes out of the skill file's own YAML, so a skill that writes
+        // `safety_mode: strict` self-certifies past all of them. `tool-safety`
+        // states "Allowlist only — tool names must match the tool registry",
+        // and `validate_tool_declarations` implemented exactly that — but
+        // nothing called it. Measured before this branch existed: a skill
+        // declaring `allowed_tools: ["NotInRegistry", "Bash(*)"]` dispatched
+        // `ready`.
+        //
+        // Scoped to the automated path deliberately. That is where
+        // `runtime-safety` puts the hard requirement, and it is the path that
+        // would execute with no human in the loop. Assisted skills get a
+        // warning instead (below): blocking them would reject the scoped-grant
+        // syntax (`Bash(scripts-run:*)`) that `tool-safety` itself prefers and
+        // that this two-entry registry does not model.
+        const toolCheck = validate_tool_declarations(skill.allowed_tools);
+        if (!toolCheck.valid) {
+            return new DispatchResult({
+                request: new ExecutionRequest({
+                    skill_name: skill.name,
+                    execution_type: skill.execution_type,
+                    handler: skill.handler,
+                    timeout_seconds: skill.timeout_seconds,
+                    safety_mode: skill.safety_mode,
+                    allowed_tools: skill.allowed_tools,
+                    status: 'blocked',
+                    reason: `Automated skill declares an untrusted tool grant — ${toolCheck.errors.join('; ')}`,
+                }),
+                warnings: [],
+            });
+        }
+    } else if (skill.allowed_tools.length > 0) {
+        // Not silently ignored: an unregistered grant on a human-confirmed
+        // path is surfaced as a warning rather than a block.
+        warnings.push(...validate_tool_declarations(skill.allowed_tools).errors);
     }
 
     // Assisted/automated skill is ready

package/src/scripts/schemas/pack.schema.json

@@ -6,7 +6,7 @@
   "$comment": "Generated by scripts/generate_pack_manifests.py and validated on load by scripts/validate_pack_yaml.py. Schema introduced in road-to-6.0.0-D Phase 0 Step 2. `dependencies` is the artefact-level include graph (skills/rules the pack's commands reference); `requires` is the pack-level hard-dependency graph (must be acyclic — enforced by scripts/lint_pack_dependencies.py).",
   "type": "object",
   "additionalProperties": false,
-  "required": ["id", "version", "artefact_count"],
+  "required": ["id", "artefact_count"],
   "properties": {
     "id": {
       "type": "string",
@@ -58,10 +58,6 @@
     "trust_level_default": {
       "type": "string"
     },
-    "version": {
-      "type": "string",
-      "minLength": 1
-    },
     "artefact_count": {
       "type": "integer",
       "minimum": 0

package/src/scripts/schemas/rule.schema.json

@@ -63,14 +63,13 @@
         "properties": {
           "keyword": {"type": "string"},
           "phrase": {"type": "string"},
-          "intent": {"type": "string"},
           "file_pattern": {"type": "string"},
           "path_prefix": {"type": "string", "description": "Literal path-prefix match pattern the host evaluates against the file the agent is editing — NOT a file reference. The rewriter leaves it verbatim. Source-of-truth rules that must fire on edits under `.agent-src.uncondensed/` keep that prefix here (the prefix ban applies only to `load_context:` and body links — see road-to-path-fixes.md P2.2 / AI-Council 2026-05-06)."},
           "command": {"type": "string"},
           "reason": {"type": "string"}
         }
       },
-      "description": "Router activation triggers (Phase 3 of road-to-kernel-and-router.md). Forbidden on kernel rules, required on non-kernel rules. Schema: docs/contracts/rule-router.md."
+      "description": "Router activation triggers (Phase 3 of road-to-kernel-and-router.md). Forbidden on kernel rules, required on non-kernel rules. Five match keys: keyword, phrase, file_pattern, path_prefix, command. `intent` was removed — it never auto-matched at runtime and only gave rule authors false confidence that an activation path existed; additionalProperties:false now rejects it. Schema: docs/contracts/rule-router.md."
     },
     "routes_to": {
       "type": "array",

package/src/scripts/self_review_gate.ts

@@ -125,79 +125,21 @@ function changedLineCount(baseRef: string, files: string[], cwd: string = REPO_R
 }
 
 // ── Release-PR detection (road-to-feedback-9.2.0-followups Phase 3) ────
-/**
- * A release PR is detected from its own packaging diff (baseRef...HEAD,
- * scoped to CHANGELOG.md + package.json): an added changelog heading and an
- * added package.json version bump, agreeing on the same version. Pure over
- * the patch text — no git call — so it is unit-testable with synthetic
- * patches. See docs/design/release-pr-review-mode.md.
- */
-export function detectReleaseVersion(patchText: string): string | null {
-    const addedLines = patchText
-        .split('\n')
-        .filter((l) => l.startsWith('+') && !l.startsWith('+++'))
-        .map((l) => l.slice(1));
-
-    let changelogVersion: string | null = null;
-    let packageVersion: string | null = null;
-    for (const line of addedLines) {
-        const changelogMatch = /^##\s*\[(\d+\.\d+\.\d+)\]/.exec(line);
-        if (changelogMatch) changelogVersion = changelogMatch[1] ?? null;
-        const packageMatch = /^\s*"version"\s*:\s*"(\d+\.\d+\.\d+)"/.exec(line);
-        if (packageMatch) packageVersion = packageMatch[1] ?? null;
-    }
-    if (changelogVersion && packageVersion && changelogVersion === packageVersion) {
-        return changelogVersion;
-    }
-    return null;
-}
-
-function releaseDetectionPatch(baseRef: string, cwd: string): string {
-    const r = spawnSync('git', ['diff', `${baseRef}...HEAD`, '--', 'CHANGELOG.md', 'package.json'], {
-        cwd,
-        encoding: 'utf8',
-        maxBuffer: 8 * 1024 * 1024,
-    });
-    return (r.stdout ?? '').toString();
-}
-
-/** Impure wrapper: collects the packaging patch via git, then detects. */
-export function detectReleaseVersionFromGit(baseRef: string, cwd: string = REPO_ROOT): string | null {
-    return detectReleaseVersion(releaseDetectionPatch(baseRef, cwd));
-}
-
-/** `major.minor.patch`, tolerating an optional `v` prefix; null if not semver-shaped. */
-function parseSemver(raw: string): [number, number, number] | null {
-    const m = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(raw.trim());
-    if (!m) return null;
-    return [Number(m[1]), Number(m[2]), Number(m[3])];
-}
-
-function semverLessThan(a: [number, number, number], b: [number, number, number]): boolean {
-    const [aMajor, aMinor, aPatch] = a;
-    const [bMajor, bMinor, bPatch] = b;
-    if (aMajor !== bMajor) return aMajor < bMajor;
-    if (aMinor !== bMinor) return aMinor < bMinor;
-    return aPatch < bPatch;
-}
-
-/**
- * Highest semver-shaped tag strictly below `version`, or null if none. Pure
- * over the supplied tag list — no git call. Non-semver tags (branch-backup
- * names etc.) are ignored rather than throwing.
- */
-export function pickPreviousTag(version: string, tags: readonly string[]): string | null {
-    const target = parseSemver(version);
-    if (!target) return null;
-    let best: { raw: string; parsed: [number, number, number] } | null = null;
-    for (const raw of tags) {
-        const parsed = parseSemver(raw);
-        if (!parsed) continue;
-        if (!semverLessThan(parsed, target)) continue;
-        if (!best || semverLessThan(best.parsed, parsed)) best = { raw, parsed };
-    }
-    return best ? best.raw : null;
-}
+//
+// Moved to `_lib/release_scope.ts` so the release-aware content checks reuse
+// this detector instead of re-deriving it (road-to-release-shape-honesty
+// Phase 1). Imported for local use AND re-exported — a bare `export … from`
+// would not bind the names in this module's scope. Public surface unchanged.
+import {
+    detectReleaseVersionFromGit,
+    pickPreviousTag,
+} from './_lib/release_scope.js';
+
+export {
+    detectReleaseVersion,
+    detectReleaseVersionFromGit,
+    pickPreviousTag,
+} from './_lib/release_scope.js';
 
 function listGitTags(cwd: string): string[] {
     const r = spawnSync('git', ['tag'], { cwd, encoding: 'utf8' });

package/src/scripts/skill_linter.ts

@@ -30,7 +30,6 @@
  *   2 = errors
  *   3 = internal error / structural malice
  */
-import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
@@ -44,6 +43,9 @@ import {
     type YamlValue,
 } from './validate_frontmatter.js';
 import { artefact_roots, resolve_logical } from './_lib/agent_src.js';
+import { ProbeOverflowError, runCountedProbe } from './_lib/counted_probe.js';
+import { resolveContentLintScope } from './_lib/release_scope.js';
+import { DeadScopeError, assertScanned } from './_lib/scan_scope.js';
 
 // __file__ equivalent for repo-root derivation (mirrors Python
 // `Path(__file__).resolve().parent.parent.parent` = <repo>/src/scripts → repo).
@@ -166,10 +168,10 @@ const DOUBLE_BLANK_PATTERN = /\n{3,}/;
 const VALID_RULE_TYPES = new Set(['always', 'auto', 'manual']);
 const VALID_RULE_SOURCES = new Set(['package', 'project']);
 
+// `intent` was removed — see compile_router.ts's copy of this allowlist.
 const ROUTER_ALLOWED_TRIGGER_KEYS = new Set([
     'keyword',
     'phrase',
-    'intent',
     'file_pattern',
     'path_prefix',
     'command',
@@ -2428,20 +2430,58 @@ export function gather_candidate_files_under(srcRoot: string): string[] {
     return sortedUnique(out);
 }
 
-export function gather_changed_candidate_files(root: string): string[] {
+/**
+ * The scope `--changed` resolved, for the caller to report.
+ *
+ * Exported alongside the file list because a release PR silently widening its
+ * own scope would be as opaque as the blindness it fixes — the caller prints
+ * this line.
+ */
+export let last_changed_scope_reason = '';
+
+/**
+ * Whether the base-span diff (`base...HEAD`) itself ran cleanly.
+ *
+ * The verified-empty release outcome (see `main`) may only rest on an empty
+ * change set that was actually COMPUTED — a base diff that errored (missing
+ * tag object, corrupt ref) degrades to the worktree fallbacks and would
+ * otherwise be indistinguishable from a genuinely empty span.
+ */
+export let last_changed_base_diff_ok = false;
+
+/**
+ * Candidate files changed against the resolved base.
+ *
+ * The base is release-aware (`_lib/release_scope.ts`): on a release PR it
+ * widens to `previous_release_tag...HEAD`, because a release PR's own diff is
+ * the version bump and the changelog — everything substantive landed in the
+ * commits before the cut. Scoped to the PR's own file list this returned
+ * nothing on a 179-commit release, and the gate reported
+ * "0 skills checked, INCONCLUSIVE" and passed.
+ *
+ * `since` pins the base explicitly and wins over detection.
+ */
+export function gather_changed_candidate_files(root: string, since?: string | null): string[] {
+    const scope = resolveContentLintScope({ cwd: root, since: since ?? null });
+    last_changed_scope_reason = scope.reason;
+    last_changed_base_diff_ok = false;
     const diffCommands = [
-        ['git', 'diff', '--name-only', 'origin/main...HEAD'],
+        ['git', 'diff', '--name-only', `${scope.base}...HEAD`],
         ['git', 'diff', '--name-only', '--cached', 'HEAD'],
         ['git', 'diff', '--name-only', 'HEAD'],
     ];
     try {
         let rawLines: string[] = [];
+        let first = true;
         for (const cmd of diffCommands) {
-            const result = spawnSync(cmd[0] as string, cmd.slice(1), {
-                cwd: root,
-                encoding: 'utf-8',
-            });
-            if (result.status === 0 && (result.stdout ?? '').trim()) {
+            // A truncated diff would silently shrink the change set — the same
+            // degrade-to-zero shape this roadmap closes elsewhere.
+            const result = runCountedProbe(cmd[0] as string, cmd.slice(1), { cwd: root });
+            if (first) {
+                last_changed_base_diff_ok = result.ok;
+                first = false;
+            }
+            if (result.ok && result.stdout.trim()) {
                 rawLines = splitlines(result.stdout);
                 break;
             }
@@ -2479,7 +2519,15 @@ export function gather_changed_candidate_files(root: string): string[] {
             }
         }
         return sortedUnique(files);
-    } catch {
+    } catch (exc) {
+        // An overflowed diff is not an empty diff. Everything else (a shallow
+        // clone with no `origin/main`, a detached worktree) legitimately has no
+        // resolvable change set and keeps the historical empty-list degrade.
+        if (exc instanceof ProbeOverflowError) {
+            throw exc;
+        }
+        last_changed_scope_reason =
+            `change set unresolvable (${exc instanceof Error ? exc.message : String(exc)})`;
         return [];
     }
 }
@@ -4082,6 +4130,8 @@ interface Args {
     report: boolean;
     repoRoot: string;
     quiet: boolean;
+    /** Explicit diff base for `--changed`; wins over release detection. */
+    since: string | null;
 }
 
 export function parse_args(argv: string[]): Args {
@@ -4095,6 +4145,7 @@ export function parse_args(argv: string[]): Args {
         condensationQuality: false,
         strictWarnings: false,
         report: false,
+        since: null,
         repoRoot: '.',
         quiet: false,
     };
@@ -4104,6 +4155,15 @@ export function parse_args(argv: string[]): Args {
             args.all = true;
         } else if (a === '--changed') {
             args.changed = true;
+        } else if (a === '--since') {
+            const v = argv[i + 1];
+            i += 1;
+            if (v === undefined || v.startsWith('--')) {
+                throw new ArgError('argument --since: expected a git ref');
+            }
+            args.since = v;
+        } else if (a.startsWith('--since=')) {
+            args.since = a.slice('--since='.length);
         } else if (a === '--format') {
             const v = argv[i + 1];
             i += 1;
@@ -4143,6 +4203,58 @@ export function parse_args(argv: string[]): Args {
 
 class ArgError extends Error {}
 
+/**
+ * True when an empty change set is a defect rather than a legitimate scope.
+ *
+ * Only on a release PR whose scope actually widened to a tag span: a release
+ * that changed no skill and no rule is possible in principle, but a *resolved*
+ * span that matched nothing is the "0 skills checked, INCONCLUSIVE" shape this
+ * gate exists to stop. A release whose previous tag could not be resolved is
+ * excluded — that scope never widened, so failing it would punish a shallow
+ * clone for the wrong reason.
+ */
+function _release_scope_requires_findings(root: string, since?: string | null): boolean {
+    const scope = resolveContentLintScope({ cwd: root, since: since ?? null });
+    return scope.isRelease && scope.previousTag !== null;
+}
+
+/**
+ * True when the `--changed` corpus filter still matches tracked files at HEAD.
+ *
+ * The discriminator between a DEAD scope and a VERIFIED-EMPTY release span.
+ * A release that touches no skill/rule file is a legitimate outcome — but only
+ * provably so when the exact predicate `gather_changed_candidate_files`
+ * applies to diff lines demonstrably still sees the corpus. Probing
+ * `git ls-files` with that same predicate means a moved projection root
+ * (the ADR-051 blindness class) fails this probe exactly as it would blind
+ * the diff — so "empty because the root moved" cannot masquerade as
+ * "empty because nothing changed".
+ */
+function _changed_filter_matches_head(root: string): boolean {
+    // Probes the canonical projection root only (ADR-051): a corpus that
+    // exists solely under a legacy path counts as dead, not alive.
+    const result = runCountedProbe('git', ['ls-files', '--', 'dist/agent-src'], { cwd: root });
+    if (!result.ok) {
+        return false;
+    }
+    for (const raw of splitlines(result.stdout)) {
+        const norm = raw.trim().replace(/\\/g, '/');
+        if (!norm || norm.includes('/evals/')) {
+            continue;
+        }
+        if (!norm.startsWith('dist/agent-src/') && !norm.includes('/dist/agent-src/')) {
+            continue;
+        }
+        if (
+            norm.endsWith('/SKILL.md') ||
+            (norm.endsWith('.md') && (norm.includes('/rules/') || norm.includes('/commands/')))
+        ) {
+            return true;
+        }
+    }
+    return false;
+}
+
 export function main(argv: string[]): number {
     let args: Args;
     try {
@@ -4162,7 +4274,8 @@ export function main(argv: string[]): number {
             paths.push(...gather_all_candidate_files(root));
         }
         if (args.changed) {
-            paths.push(...gather_changed_candidate_files(root));
+            paths.push(...gather_changed_candidate_files(root, args.since));
+            process.stderr.write(`skill_linter --changed: ${last_changed_scope_reason}\n`);
         }
         for (const raw of args.paths) {
             const p = path.isAbsolute(raw) ? raw : path.resolve(root, raw);
@@ -4183,6 +4296,42 @@ export function main(argv: string[]): number {
             } else if (args.format === 'json') {
                 process.stdout.write(`${format_json([])}\n`);
             }
+            // A release PR that resolved a real tag span and still matched
+            // nothing needs a discriminator: DEAD scope (the diff errored, or
+            // the corpus filter no longer matches anything at HEAD — the
+            // ADR-051 moved-root blindness) fails; VERIFIED-EMPTY (the base
+            // diff ran cleanly AND the filter provably still sees tracked
+            // corpus files) is a legitimate release that simply changed no
+            // skill/rule — failing it would red every scripts-/docs-only
+            // release forever. Mirrors the scan-scope regime
+            // (`_lib/scan_scope.ts`; exit 2, as `check_iron_law_prominence`).
+            // Ordinary PRs keep the historical exit 0: a change set with no
+            // skill or rule in it is a legitimate empty scope, not a dead one.
+            if (args.changed && _release_scope_requires_findings(root, args.since)) {
+                if (last_changed_base_diff_ok && _changed_filter_matches_head(root)) {
+                    process.stderr.write(
+                        '✅  verified-empty release scope: the base-span diff ran cleanly and ' +
+                            'the corpus filter still matches tracked files at HEAD — this ' +
+                            'release genuinely changes no skill/rule file. The gate is alive, ' +
+                            'not blind.\n',
+                    );
+                } else {
+                    try {
+                        assertScanned({
+                            gate: 'skill_linter --changed (release PR)',
+                            scanned: 0,
+                            units: 'skill/rule files',
+                            roots: [last_changed_scope_reason],
+                        });
+                    } catch (exc) {
+                        if (exc instanceof DeadScopeError) {
+                            process.stderr.write(`❌  ${exc.message}\n`);
+                            return 2;
+                        }
+                        throw exc;
+                    }
+                }
+            }
             process.stderr.write('No matching skill/rule files found.\n');
             return 0;
         }