@event4u/agent-config 9.13.0 → 9.15.0

package/dist/ui/index.html

@@ -27,7 +27,7 @@
                 document.documentElement.setAttribute('data-theme', theme);
             })();
         </script>
-      <script type="module" crossorigin src="/assets/index-BpSQt5vm.js"></script>
+      <script type="module" crossorigin src="/assets/index-DJY_vQVn.js"></script>
       <link rel="stylesheet" crossorigin href="/assets/index-jSfMW8_t.css">
     </head>
     <body>

package/docs/guidelines/agent-infra/roadmap-progress-mechanics.md

@@ -218,7 +218,7 @@ Keep aligned with the dashboard counter in `scripts/update_roadmap_progress.ts`
 
 `[~]` is **not** an "in-progress" indicator. Mid-reply work-in-flight has no checkbox change until the step lands; that's a normal `[ ] → [x]` transition.
 
-**Dashboard regen cadence — opt-in batching.** The checkbox flip is non-batchable. The **subprocess regen** (`./agent-config roadmap:progress`) is batchable per `roadmap.dashboard_regen_cadence` in `.agent-settings.yml` (`per_step` default · `every_5_steps` · `phase_boundary`). Run end, phase boundary, and any file-shape touch (rename / phase add / archive — Iron Law 1) always force an immediate regen regardless of cadence.
+**Dashboard regen cadence — opt-in batching.** The checkbox flip is non-batchable. The **subprocess regen** (`./agent-config roadmap:progress`) is batchable per `roadmap.dashboard_regen_cadence` in `.agent-settings.yml` (`every_5_steps` default · `per_step` · `phase_boundary`). Run end, phase boundary, and any file-shape touch (rename / phase add / archive — Iron Law 1) always force an immediate regen regardless of cadence.
 
 **Blockers follow the same cadence as checkboxes.** Clearing a `## Blockers` entry (per `templates/roadmaps.md` rule 20) flips its `Status: resolved` and regenerates the dashboard in the same reply — Iron Law 1's "same response" obligation applies to blocker resolution exactly as it applies to a checkbox flip.
 

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "9.13.0",
+    "version": "9.15.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
     "license": "MIT",
     "private": false,
@@ -87,20 +87,20 @@
         "provenance": true
     },
     "devDependencies": {
-        "@inquirer/prompts": "^7.10.1",
-        "@playwright/test": "^1.60.0",
-        "@preact/preset-vite": "^2.10.5",
+        "@inquirer/prompts": "^8.5.2",
+        "@playwright/test": "^1.62.1",
+        "@preact/preset-vite": "^2.10.6",
         "@testing-library/preact": "^3.2.4",
         "@types/js-yaml": "^4.0.9",
-        "@types/node": "^20.19.41",
-        "@typescript-eslint/eslint-plugin": "^8.59.4",
+        "@types/node": "^26.1.2",
+        "@typescript-eslint/eslint-plugin": "^8.65.0",
         "@typescript-eslint/parser": "^8.59.4",
         "eslint": "^9.39.4",
-        "happy-dom": "^20.9.0",
+        "happy-dom": "^20.11.1",
         "js-tiktoken": "^1.0.21",
         "publint": "^0.3.22",
         "tree-sitter-wasms": "0.1.13",
-        "tsx": "^4.22.3",
+        "tsx": "^4.23.1",
         "typescript": "^5.9.3",
         "vite": "^5.4.21",
         "vitest": "^2.1.9",
@@ -108,11 +108,11 @@
     },
     "dependencies": {
         "@fastify/static": "^10.1.2",
-        "@modelcontextprotocol/sdk": "^1.29.0",
-        "@preact/signals": "^2.9.0",
+        "@modelcontextprotocol/sdk": "^1.30.0",
+        "@preact/signals": "^2.10.0",
         "commander": "^12.1.0",
         "execa": "^9.5.0",
-        "fastify": "^5.8.0",
+        "fastify": "^5.11.0",
         "js-yaml": "^4.1.0",
         "open": "^10.2.0",
         "preact": "^10.29.0",

package/src/agent-src/templates/AGENTS.md

@@ -30,5 +30,5 @@
 2. **What language?** — Project-specific; agents mirror the user's language at runtime.
 3. **Where do I edit agent-config?** — Do not edit `.augment/` or `dist/agent-src/` here; they are installed artifacts. Project edits live in `agents/` and project source.
 4. **Lint / test / sync entry point?** — Project-specific (see project README); agent-config reinstalls via `composer update event4u/agent-config` or `npm update @event4u/agent-config`.
-5. **Where do the always-active rules live?** — `dist/agent-src/rules/` (kernel = 9 Iron-Law rules; tier-1 / tier-2 routed via `dist/agent-src/router.json`).
+5. **Where do the always-active rules live?** — `dist/agent-src/rules/` (kernel = 9 Iron-Law rules; tier-1 / tier-2 routed via `dist/router.json`).
 6. **Per-module agent docs?** — If `modules.enabled: true`, each module under `modules.root_paths` may carry its own `{agent_folder}/` (default `agents/`). See `module-management` skill.

package/src/agent-src/templates/scripts/work_engine/orchestration.ts

@@ -104,7 +104,7 @@ interface DispatchHookModule {
  * reachable both when this module runs from the consumer projection
  * (`dist/agent-src/templates/scripts/work_engine/`) and from the
  * source-of-truth tree
- * (`packages/<pack>/.agent-src.uncondensed/templates/scripts/work_engine/`).
+ * (`src/agent-src/templates/scripts/work_engine/`).
  * Loaded by dynamic `import()` to avoid namespace collisions with test
  * modules named `hooks` (the TS analogue of the Python importlib-by-path
  * approach).

package/src/config/agent-settings.template.yml

@@ -83,6 +83,25 @@ projection:
   # a non-kernel rule also needs a `packs:` intersection to project — e.g.
   # deselecting `frontend-design` removes ui-audit-gate + design-fidelity.
   # Empty = inactive, same as rule_workspaces.
+  #
+  # `rule_packs: auto` derives the id list from the ACTIVE-PACK set — the same
+  # set the skill/command prune uses — instead of hand-typing ids that would
+  # need re-typing whenever a pack is added. It exists because a domain safety
+  # floor whose own body says "auto-activates when pack-X is installed" ships
+  # today into installs that have no pack-X, where it guards nothing. Measured
+  # on this repo (2026-08-02): `auto` drops 8 rules / 8,110 GPT tok — the six
+  # domain floors plus provider-lifecycle-discipline and
+  # spreadsheet-source-quality. `history-discipline` and `scale-discipline`
+  # correctly SURVIVE (their packs are engineering-workspace packs).
+  #
+  # The DEFAULT stays `[]`. Flipping it to `auto` changes what a consumer
+  # install receives and therefore inherits the same human release gate the
+  # workspace axis carries (2026-07-13,
+  # agents/settings/contexts/consumer-scoping-audit-2026-07-07.md) — that
+  # audit's "unsure → ship it" ruling was about the maintainer-vs-consumer
+  # WORKSPACE question, not about a pack condition the rule declares itself,
+  # but the gate applies to the flip either way. Do not set this from
+  # automation.
   rule_packs: []
 
 # --- Discipline profile (successor knob, opt-in until the evidence gates pass) ---
@@ -207,6 +226,16 @@ cost:
     weekly: 0
     # Monthly USD ceiling (rolling 30d). 0 / null = no monthly budget.
     monthly: 0
+    # Per-model-tier USD ceilings for budget-aware cheap-request delegation
+    # (docs/contracts/budget-routing.md; council 2026-08-03). null = no
+    # separate tier cap — the global ceilings above still apply and the
+    # budget-routing relation works purely off them. Set a value to cap one
+    # tier (e.g. cheap: 10 keeps haiku-class delegation under $10/day-window
+    # of the ledger). Consumed by subagents.budget_routing below.
+    per_tier:
+      cheap: null
+      medium: null
+      strong: null
   # Enforcement mode at the HARD_STOP tier (100% utilization):
   #   advisory  = dashboards and `cost:check` show the breach; agent
   #               keeps working. Default. Safe for greenfield projects.
@@ -256,7 +285,11 @@ personal:
   # greeting silently disappears, the context window is degrading and it is
   # time for a fresh conversation. Also keeps the reply-close markers alive
   # (ONE end-summary; PR URL as the literal last line).
-  # Empty = feature off. See rules/session-canary.md.
+  # Personal concern, resolved user-globally: empty here falls back to the
+  # user-global settings' personal.canary_name and then to identity.name in
+  # the wizard's settings/.agent-user.yml — set this key only to OVERRIDE
+  # the global name per project. No name on any layer = feature off.
+  # See rules/session-canary.md.
   canary_name: ""
 
   # Prefix PR comment replies with a bot icon 🤖 (true, false)
@@ -458,14 +491,14 @@ roadmap:
   # of the run, at every phase boundary, and at run end — this knob
   # only affects the inter-step beat.
   #
-  #   per_step         = legacy default: regen after every checkbox flip.
-  #                      Safest for crash recovery; highest subprocess
-  #                      overhead. Use when a session may be killed
-  #                      mid-roadmap and a fresh dashboard must always
-  #                      reflect the last-saved step.
-  #   every_5_steps    = batch flips, regen every 5 closed steps + at
-  #                      every phase boundary. Balanced cost/freshness
-  #                      for runs of 20–100 steps.
+  #   per_step         = regen after every checkbox flip. Safest for
+  #                      crash recovery; highest subprocess overhead.
+  #                      Use when a session may be killed mid-roadmap
+  #                      and a fresh dashboard must always reflect the
+  #                      last-saved step.
+  #   every_5_steps    = default: batch flips, regen every 5 closed
+  #                      steps + at every phase boundary. Balanced
+  #                      cost/freshness for runs of 20–100 steps.
   #   phase_boundary   = regen only at phase boundaries + run end.
   #                      Cheapest for long roadmaps (100+ steps).
   #                      The checkbox flip itself is still inline per
@@ -474,8 +507,10 @@ roadmap:
   # `process-step` ignores this knob (single-step runs always regen
   # at the end of the step). The Iron Law 1 mandate to regen on any
   # file-shape touch (rename / phase add / archive) still fires
-  # immediately regardless of this setting.
-  dashboard_regen_cadence: per_step
+  # immediately regardless of this setting — so the dashboard is never
+  # stale across a rename, a phase add, or an archive, whatever the
+  # inter-step beat is.
+  dashboard_regen_cadence: every_5_steps
 
   # Visible-horizon framing in roadmap authoring (integer weeks, default 0).
   # 0  = off (default). Time-boxed plate / horizon framing is forbidden:
@@ -679,6 +714,19 @@ subagents:
   # false = every subagent runs on the session tier.
   downshift: true
 
+  # Budget-aware cheap-request delegation (docs/contracts/budget-routing.md).
+  # Picks the cheapest CLASSIFIER-ADEQUATE tier that has available budget
+  # (cost.budgets.per_tier above); cheap exhausted but strong funded → strong
+  # tier; everything exhausted → session model + notice. Work is never
+  # blocked to save money, and the session model is never switched — routing
+  # happens as delegation with a model override. DISTINCT from `downshift`
+  # above: downshift is the quality/cost trade-off knob, budget_routing is
+  # the resource-availability gate (council 2026-08-03).
+  #   ask  = (default) first budget-motivated downshift of a session asks once
+  #   auto = apply the relation silently (telemetry line per routed request)
+  #   off  = today's behavior; single-flip rollback
+  budget_routing: ask
+
   # Prefer a separate-quota-pool model for delegable sub-tasks WHERE the host
   # manifest reports `separate_quota_pool: true` (e.g. a subscription whose
   # Sonnet allowance is distinct from Opus). Optional bonus only — behaviour is

package/src/config/ci-local-parity.yml

@@ -66,7 +66,15 @@ pre_push_budget_seconds: 25
 #   artifact       needs something only CI builds (site, tarball, bundle)
 #   benchmark      it is a measurement, timing-sensitive or paid
 #   matrix         needs an OS or Node version this machine is not
+#   resolver       not a gate at all — a helper a workflow step calls to compute
+#                  something (a diff base, a scope); it decides and blocks nothing
 ci_only:
+  - id: check_evaluator_budgets
+    class: benchmark
+    reason: "asserts against a measurements JSON that only the nightly evaluator-umbrella run produces — with no artifact there is nothing local to compare against"
+  - id: resolve_lint_scope
+    class: resolver
+    reason: "not a gate — the diff-base resolver skill-lint.yml shell steps call so they scope from the same source as `skill_linter --changed`; it decides nothing and blocks nothing"
   - id: adoption_snapshot
     class: network
     reason: "live api.npmjs.org + api.github.com calls, reads GITHUB_TOKEN"

package/src/config/discovery/unassigned-artefacts.yml

@@ -18,21 +18,21 @@
 # /skill-management, /override:create, etc. They carry no runtime
 # frontmatter on purpose: the consuming command fills it in. Quarantined
 # from the discovery manifest so strict mode stays clean.
-- path: .agent-src.uncondensed/templates/AGENTS.md
+- path: src/agent-src/templates/AGENTS.md
   reason: scaffold template for new project AGENTS.md; placeholders filled by /agents init
-- path: .agent-src.uncondensed/templates/agent-settings.md
+- path: src/agent-src/templates/agent-settings.md
   reason: scaffold for project .agent-settings.yml
-- path: .agent-src.uncondensed/templates/command.md
+- path: src/agent-src/templates/command.md
   reason: scaffold for new slash-command authoring
 - path: src/agent-src/templates/tickets.md
   reason: scaffold template for ticket-bundle tickets (ADR-101); carries no runtime frontmatter — emit-tickets fills it in per ticket
-- path: .agent-src.uncondensed/templates/contexts.md
+- path: src/agent-src/templates/contexts.md
   reason: scaffold index for project contexts/
-- path: .agent-src.uncondensed/templates/contexts/auth-model.md
+- path: src/agent-src/templates/contexts/auth-model.md
   reason: scaffold for project auth-model context
-- path: .agent-src.uncondensed/templates/contexts/data-sensitivity.md
+- path: src/agent-src/templates/contexts/data-sensitivity.md
   reason: scaffold for project data-sensitivity context
-- path: .agent-src.uncondensed/templates/contexts/deployment-order.md
+- path: src/agent-src/templates/contexts/deployment-order.md
   reason: scaffold for project deployment-order context
 - path: src/agent-src/templates/contexts/knowledge-card.md
   reason: fill-in skeleton for committed knowledge cards (evidence-first structure discovery / ADR-098); frontmatter is the example shape a filled card carries, not a runtime artefact
@@ -40,37 +40,35 @@
   reason: convention doc for the typed agents/knowledge/ page directories (road-to-knowledge-system); documents the optional page frontmatter shape, carries none itself
 - path: src/agent-src/templates/contexts/lesson-card.md
   reason: fill-in skeleton for Class-C learned lessons (Evidence v2 project-intelligence); frontmatter is the example shape a filled lesson carries, not a runtime artefact
-- path: .agent-src.uncondensed/templates/contexts/observability.md
+- path: src/agent-src/templates/contexts/observability.md
   reason: scaffold for project observability context
-- path: .agent-src.uncondensed/templates/contexts/tenant-boundaries.md
+- path: src/agent-src/templates/contexts/tenant-boundaries.md
   reason: scaffold for project tenant-boundaries context
-- path: .agent-src.uncondensed/templates/copilot-instructions.md
+- path: src/agent-src/templates/copilot-instructions.md
   reason: scaffold for project copilot-instructions.md
-- path: .agent-src.uncondensed/templates/features.md
+- path: src/agent-src/templates/features.md
   reason: scaffold for project features.md catalogue
-- path: .agent-src.uncondensed/templates/overrides/command.md
+- path: src/agent-src/templates/overrides/command.md
   reason: scaffold for project override of a shared command
-- path: .agent-src.uncondensed/templates/overrides/guideline.md
+- path: src/agent-src/templates/overrides/guideline.md
   reason: scaffold for project override of a shared guideline
-- path: .agent-src.uncondensed/templates/overrides/rule.md
+- path: src/agent-src/templates/overrides/rule.md
   reason: scaffold for project override of a shared rule
-- path: .agent-src.uncondensed/templates/overrides/skill.md
+- path: src/agent-src/templates/overrides/skill.md
   reason: scaffold for project override of a shared skill
-- path: .agent-src.uncondensed/templates/overrides/template.md
+- path: src/agent-src/templates/overrides/template.md
   reason: scaffold-of-scaffold for new override types
-- path: .agent-src.uncondensed/templates/persona.md
+- path: src/agent-src/templates/persona.md
   reason: scaffold for new persona authoring
-- path: .agent-src.uncondensed/templates/roadmaps.md
+- path: src/agent-src/templates/roadmaps.md
   reason: scaffold for new roadmap authoring
-- path: .agent-src.uncondensed/templates/rule.md
+- path: src/agent-src/templates/rule.md
   reason: scaffold for new rule authoring
-- path: .agent-src.uncondensed/templates/scripts/.pytest_cache/README.md
-  reason: pytest cache artefact, not an agent-config artefact
-- path: .agent-src.uncondensed/templates/scripts/README.md
+- path: src/agent-src/templates/scripts/README.md
   reason: scaffold README for project scripts/
-- path: .agent-src.uncondensed/templates/skill-archive-note.md
+- path: src/agent-src/templates/skill-archive-note.md
   reason: scaffold for archive-note generation
-- path: .agent-src.uncondensed/templates/skill.md
+- path: src/agent-src/templates/skill.md
   reason: scaffold for new SKILL.md authoring
-- path: .agent-src.uncondensed/README.md
+- path: src/agent-src/README.md
   reason: package-root orientation; carries no artefact frontmatter — follows package core

package/src/config/evaluator-budgets.json

@@ -4,43 +4,73 @@
     "owner": "maintainer",
     "review_by": "2027-07-27",
     "regression_pct": 10,
+    "posture": {
+        "on_release": "fail",
+        "on_main_and_prs": "warn",
+        "on_local": "fail",
+        "always_blocking": ["a metric with no measurement supplied"],
+        "rationale": "road-to-gates-that-can-fail Phase 5. A hard fail on main turns every legitimate command addition into a blocked merge, which is how budgets get quietly raised with a cushion instead of consciously — so budget / regression / drift findings are ADVISORY on main, the nightly and ordinary PRs, and BLOCKING on a release ref. Not a weakening: before the Phase-4 path triggers, this gate ran on release PRs and the nightly only, so the surfaces that now warn never saw it at all. A LOCAL run (no CI env) is strict, because a maintainer running it by hand — including release.ts — wants the strict answer and blocks nobody. A metric with NO measurement is always blocking in either posture: that is a broken harness reporting green on nothing. Implemented in src/scripts/check_evaluator_budgets.ts::detectPosture; override with --posture warn|fail.",
+        "delivery": "This posture IS the nightly-visibility route (council 2026-08-02, blocker nightly-visibility-owner), not a second mechanism beside it: the nightly publishes measurement_record below, a later run re-measures and compares, and the contradiction warns on main / fails on release. No notification channel, no auto-managed issue — a one-maintainer channel producing routine noise gets muted, and a muted channel reproduces the original failure."
+    },
+    "measurement_record": {
+        "path": "agents/evidence/metrics/evaluator-measurements.json",
+        "written_by": "src/scripts/evaluator_umbrella.sh (UMBRELLA_RECORD=1 — the nightly sets it)",
+        "compared_by": "src/scripts/check_evaluator_budgets.ts --recorded",
+        "note": "Only entries WITHOUT `deterministic: false` participate in the drift comparison. The council's recorded objection was that a non-deterministic comparison produces noise and gets ignored; determinism is therefore a precondition, verified per metric, not an assumption."
+    },
+    "remeasurement_2026_08_02": {
+        "verified_against_a_fresh_run": {
+            "cli_help_command_count": "80 — three consecutive runs of the pinned method on an unchanged tree returned 80/80/80. Matches last_measured; deterministic confirmed.",
+            "mcp_public_tool_count": "19 — two consecutive tools/list runs on a freshly built dist/mcp/server.mjs returned 19/19. Matches last_measured; deterministic confirmed."
+        },
+        "not_re_measured": "unpacked_size_mb, node_modules_mb, runtime_dep_count, cli_version_cold_ms, mcp_boot_to_initialize_ms. All five require the packed-tarball harness (npm pack of a fully built tree, then a clean `npm install --omit=dev <tarball>` into a scratch project) that evaluator_umbrella.sh runs in CI. They were NOT re-measured in this pass and their values remain the 2026-07-27 acceptance numbers — stated rather than invented. The next nightly writes the real numbers into measurement_record, and the drift check then reports any contradiction with last_measured on the PR that carries it."
+    },
     "budgets": {
         "unpacked_size_mb": {
             "max": 28,
             "last_measured": 26.05,
+            "last_measured_at": "2026-07-27",
             "method": "npm pack --json → dist.unpackedSize / 1e6 — includes the Phase-1 precompiled bundles (dist/hooks/dispatch.js + dist/mcp/server.mjs, ~2.1 MB) that bought the 23x hook-latency win and the tsx removal, plus dist/cli-delegate/ (~1.40 MB, ADR-204) which finished that removal for the consumer command surface. This gate is the ONLY size trip-wire on those bundles by design: a dedicated per-bundle budget key would need its own measurement wired into evaluator_umbrella.sh, and an unwired key fails check_evaluator_budgets with 'no measurement supplied' instead of guarding anything. ADR-204 projected 27.45 against max 28 without packing — the next real measurement here is the confirming one, and headroom is thin"
         },
         "node_modules_mb": {
             "max": 140,
             "last_measured": 127,
+            "last_measured_at": "2026-07-27",
             "method": "du -sm node_modules after `npm install --omit=dev <tarball>` in a clean project"
         },
         "runtime_dep_count": {
             "max": 200,
             "last_measured": 187,
+            "last_measured_at": "2026-07-27",
             "method": "package-lock.json packages count (minus root) of the clean --omit=dev install"
         },
         "cli_version_cold_ms": {
             "max": 1500,
             "last_measured": 370,
+            "last_measured_at": "2026-07-27",
             "method": "wall-clock of the FIRST `agent-config --version` after install (cold fs cache run counts)",
-            "regression_pct": 200
+            "regression_pct": 200,
+            "deterministic": false
         },
         "mcp_boot_to_initialize_ms": {
             "max": 2000,
             "last_measured": 264,
+            "last_measured_at": "2026-07-27",
             "method": "initialize request piped to `node dist/mcp/server.mjs`, wall-clock to response",
-            "regression_pct": 200
+            "regression_pct": 200,
+            "deterministic": false
         },
         "cli_help_command_count": {
-            "max": 80,
-            "last_measured": 80,
+            "max": 81,
+            "last_measured": 81,
+            "last_measured_at": "2026-08-03",
             "method": "registry enumeration — count of `{ name: '...', disposition` entries in src/cli/registry.ts (NOT --help prose parsing; methods historically disagreed 74 vs 76 vs 79)",
-            "baseline_note": "79 → 80 on 2026-07-29 (9.9.0). This RECORDS growth that already shipped through its own reviewed PRs; it does not authorize new surface. Net +6 registry entries since the 9.8.0 tag (7 added — code-graph, knowledge, analytics, memory:get, memory:learn, rtk:detect, dispatch:hook; 1 removed — the old dispatch:hook entry), and the frozen 79 was never re-measured after them. The gate did its job: it made the drift visible at release time rather than letting it accrue silently. Next addition breaches again by design."
+            "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR."
         },
         "mcp_public_tool_count": {
             "max": 19,
             "last_measured": 19,
+            "last_measured_at": "2026-08-02",
             "method": "tools/list length on the stdio server (post-ADR-132: implemented tools only)"
         }
     }

package/src/config/gate-coverage.yml

@@ -38,6 +38,51 @@
 #                pending = not yet emitting `scanned:`. The guard REPORTS these
 #                rather than skipping silently: its own partial coverage must be
 #                visible, or it repeats the sin it exists to catch.
+#   canary       optional mutation recipe (Phase 7) — see CANARY below
+#
+# COVERAGE — THE HONEST DENOMINATOR (measured 2026-08-02)
+# ------------------------------------------------------
+# 211 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`.
+# **8 of them emit the machine-readable `scanned: <N>` line under their
+# CI-identical argv, and all 8 are listed below.** The manifest is therefore
+# complete with respect to its own contract, and covers ~4 % of the gate
+# population.
+#
+# The other ~203 are NOT covered, for one reason: rule 1. They print their count
+# in prose ("111 file(s) scanned", "0 declarer(s)") or not at all, and a guard
+# that parses prose is the fragile thing being replaced. Padding this list with
+# them would manufacture exactly the false green the file exists to prevent.
+#
+# Closing the gap is one line per gate, not a new mechanism: a gate that already
+# computes its count for `_lib/scan_scope.assertScanned` need only also write
+# `scanned: <N>`. Seven gates are one line away today — they call `assertScanned`
+# / `assertWatchlistResolves` with a real count in hand: `audit_skill_overlap`,
+# `check_iron_law_prominence`, `check_safety_floor_untouched`, `lint_handoffs`,
+# `lint_namespace`, `lint_artefact_frontmatter`, `skill_linter` (listed).
+# `tests/scripts/check_gate_coverage.test.ts` fails the build the moment a gate
+# starts emitting the line without being registered here, so the list cannot
+# silently fall behind again (that omission is exactly how `check_site_links`
+# reported green over a stale build for weeks).
+#
+# CANARY (road-to-gates-that-can-fail Phase 7)
+# --------------------------------------------
+# Coverage proves a gate READ something. It cannot prove the gate can still FAIL.
+# An optional `canary:` block declares one revertible violation for the gate:
+#
+#   canary:
+#     class:   defect class planted (gate-surface classes, not the review-side
+#              five; the shared contract is cadence + sealing + never-ships)
+#     path:    repo-relative file to CREATE (must not already exist)
+#     content: the planted body
+#
+# `--canary` plants it, runs the gate with the same CI-identical argv, records
+# red/green, and deletes the plant in a `finally`. Create-only is deliberate: an
+# in-place edit would need byte-exact restoration of a tracked file, and a canary
+# that can corrupt the tree violates the never-ships rule it inherits. The
+# consequence is a real gap — a gate whose only possible violation is a
+# modification of an existing tracked artefact (`check_condensation`, whose
+# contract is `dist == rewrite(src)`; `check_ci_local_parity`, whose corpus is
+# workflow files) carries no recipe and is reported UNPROVEN, never green.
 gates:
   - id: check_condensation
     argv: []
@@ -50,6 +95,16 @@ gates:
     min_scanned: 80
     corpus: "auto-type rules carrying a description (98 at baseline)"
     status: enforced
+    canary:
+      class: oversized-artifact
+      path: src/rules/zz-canary-probe.md
+      content: |
+        ---
+        type: auto
+        description: "zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz"
+        ---
+
+        Planted canary: a 180-char auto-rule description, 30 over the cap.
     note: >
       Retargeted 2026-07-29 from the ADR-051-emptied tree (0 -> 98). It printed
       "All 0 auto-rule descriptions" and exited 0 in CI. Retargeting surfaced 16
@@ -64,6 +119,18 @@ gates:
     min_scanned: 180
     corpus: "md files inspected for a load_context block: src/rules + src/agent-src/contexts + agents/settings/contexts (231 at baseline, 17 declarers)"
     status: enforced
+    canary:
+      class: dead-target
+      path: src/rules/zz-canary-probe.md
+      content: |
+        ---
+        type: auto
+        description: "Planted canary rule declaring a load_context target that does not exist."
+        load_context:
+          - contexts/zz-canary-target-does-not-exist.md
+        ---
+
+        Planted canary: a declared context target with nothing behind it.
     note: >
       Retargeted 2026-07-29 from the ADR-051-emptied tree: 0 -> 231 files, and it
       immediately found a real violation the blindness had hidden
@@ -80,6 +147,11 @@ gates:
     min_scanned: 380
     corpus: "skills + rules under artefact_roots() (429 at baseline)"
     status: enforced
+    canary:
+      class: malformed-frontmatter
+      path: src/skills/zz-canary-probe/SKILL.md
+      content: |
+        Planted canary: a SKILL.md with no frontmatter block at all.
     note: >
       NOT blind — the manifest's regression case for rule 2. The sweep's bare
       probe made it look blind; `--all` scans 429. Enforced precisely so that
@@ -91,6 +163,17 @@ gates:
     min_scanned: 700
     corpus: "stable artefacts across src/{rules,skills,agent-src/*} + docs/ + agents/settings/contexts (872 at baseline)"
     status: enforced
+    canary:
+      class: stale-reference
+      path: src/rules/zz-canary-probe.md
+      content: |
+        ---
+        type: auto
+        description: "Planted canary rule linking a stable artefact into the transient roadmap tree."
+        ---
+
+        See [the plan](../../agents/roadmaps/road-to-nowhere.md) — the exact
+        stable-to-transient link this gate exists to reject.
     note: >
       Retargeted 2026-07-29 from the ADR-051-emptied tree. It had been enforcing the
       no-roadmap-references rule for docs/ only while the rule + skill layer went
@@ -102,10 +185,30 @@ gates:
     min_scanned: 900
     corpus: "reference corpus: src/{rules,skills,agent-src/commands,agent-src/contexts,domains} + agents/roadmaps (1170 at baseline)"
     status: enforced
+    canary:
+      class: orphan-artifact
+      path: src/agent-src/contexts/zz-canary-probe.md
+      content: |
+        # Planted canary: a context nothing in the reference corpus points at.
     note: >
       Retargeted 2026-07-29. An empty reference corpus makes every "unreferenced
       context" verdict vacuous, which is how the dead root stayed invisible.
 
+  - id: check_ci_local_parity
+    argv: ["--quiet"]
+    min_scanned: 380
+    corpus: "CI + local gate invocations parsed from .github/workflows + taskfiles (443 at baseline)"
+    status: enforced
+    note: >
+      Registered 2026-08-02. It already emitted the contract line on every path,
+      including the failing one — it was simply never listed, the same omission
+      that let check_site_links report green over a stale build. Found by the
+      registry-completeness test rather than by another sweep, which is the point
+      of adding that test. NO CANARY RECIPE: its corpus is the workflow and
+      taskfile set, so the only plantable violation is a new file under
+      .github/workflows — a surface the canary must not write to. Reported
+      UNPROVEN by --canary, never green.
+
   - id: check_site_links
     argv: []
     min_scanned: 20
@@ -125,3 +228,47 @@ gates:
       shards — is NOT listed here because it was deleted rather than repaired
       (skill_linter --all already covers all 429 artefacts in 0.5s).
 
+
+  # ── Registered 2026-08-02 (road-to-renewal-foundation Phase 1) ───────────
+  # All three were repaired in the same change from scanning a root ADR-051
+  # deleted. Each exited 0 the whole time it was blind, which is why the
+  # registration matters more than the repair: the repair fixes today, the
+  # floor is what makes the next path migration LOUD instead of silent.
+  # The roadmap step asked for `assertScanned` to be made mandatory across all
+  # corpus gates; this manifest is the stronger form of the same guarantee —
+  # `assertScanned` can only distinguish 0 from 1, while a floor also catches
+  # the 1566 → 3 collapse that a `> 0` check reports as healthy.
+
+  - id: check_portability
+    argv: []
+    min_scanned: 1200
+    corpus: "all .md under src/ + dist/agent-src/ plus the shipped root files (1,566 at baseline)"
+    status: enforced
+    note: >
+      SCAN_DIRS named the retired authoring root, so the entire src/ tree —
+      more than half the corpus — was skipped and an identifier authored there
+      was caught only once a condense run projected it into dist/agent-src/.
+
+  - id: check_references
+    argv: []
+    min_scanned: 800
+    corpus: ".md under the scanned roots plus memory YAML (1,043 at baseline)"
+    status: enforced
+    note: >
+      src/ was absent from every reference-resolution candidate list, so a link
+      resolvable only under the source of truth was reported BROKEN. The
+      failure direction was false-positive rather than false-green, but the
+      cause was the same dead root.
+
+  - id: lint_framework_leakage
+    argv: []
+    min_scanned: 350
+    corpus: "skills / rules / commands .md (431 at baseline)"
+    status: enforced
+    note: >
+      Its human summary prints "N hits across M files", where M is files WITH
+      HITS — 0 on a clean run. Reading that as coverage is precisely how a
+      blind gate looks healthy, so this gate now emits a separate `scanned:`
+      count. Its inventory-file exemption was also dead: it compared against
+      the retired root AND against 'dist/agent-src' as a single path segment,
+      which a '/'-split can never yield.

package/src/config/gate-violation-baselines.json

@@ -0,0 +1,25 @@
+{
+  "$comment": "Violation ratchet for gates whose dead scan root was repaired. A repair REVEALS pre-existing debt; it does not create it. Each entry records the count revealed at repair time — the gate fails only when its count RISES. Lowering a count is a normal commit; raising one is a defect. Entries expire: a baseline that has not dropped within 56 days of `landed` (or of `reaffirmed.date`) fails its gate, because a number that never moves is suppression with extra steps. Mechanism + rationale: src/scripts/_lib/gate_baseline.ts. Decision: AI council 2026-08-02, roadmap road-to-gates-that-can-fail blocker `dead-gate-finding-triage`.",
+  "gates": {
+    "check_no_new_legacy_path:hardcoded-scan-roots": {
+      "count": 51,
+      "landed": "2026-08-02",
+      "note": "Lines under src/scripts/**/*.{ts,mts,mjs} that pass the retired `.agent-src.uncondensed` directory into `path.join(...)` — a filesystem path CONSTRUCTED against the tree ADR-051 abandoned, which is the exact shape of all 14 dead gates. Deliberately narrow so the number is signal, not noise: 236 raw mentions under src/scripts → 147 string-literal lines → 67 path-constructing lines when the pass was written, after exempting src/scripts/_lib/agent_src.ts (the shared resolver, whose job IS owning the constant — gates that route through it survived the move). Detectors holding the literal as data to match, strip, or print are not counted, and no prose, docs, tests or fixtures are read: that full-tree shape was measured at 44 files / 213 hits and rejected as the wrong lint (see the note in check_no_new_legacy_path.ts::find_offenders). Recorded at 58 rather than 67 because Phase 1's scan-root repairs were landing on this branch while the pass was being written and had already removed 9 — a baseline above the truth silently permits new violations. This count goes to ZERO as the remaining repairs land; every repair is a lowering commit. Lowered 56→51 by the road-to-renewal-foundation Phase 1 dead-root sweep (check_always_budget, check_portability, check_references, lint_framework_leakage, lint_agents_md)."
+    },
+    "audit_user_type_axis": {
+      "count": 1,
+      "landed": "2026-08-02",
+      "note": "One orphan user-type value: `legal`. Five legal-review-prep skills (contract-review, dpa-review, nda-triage, legal-intake-triage, legal-practice-profile) declare `recommended_for_user_types: [legal]`, but there is no `user-types/legal.yml` — the pack shipped an axis value with no user-type definition behind it, and the dead scan root hid it (the audit reported used=0 orphans=0 while reading zero skills; it now reads 288 and reports used=8). Clearing this entry is a product call, not a copy edit: either author `user-types/legal.yml` (tagline, recommended packs, install-path hint) or drop `legal` from those five skills. Not decided here because both options change shipped pack behaviour."
+    },
+    "lint_handoffs": {
+      "count": 18,
+      "landed": "2026-08-02",
+      "note": "All 18 are `handoff_tier_mismatch`: a senior-tier skill links to a peer whose frontmatter carries no `tier` (reported as tier='unset') — e.g. build-buy-partner → adr-create, customer-research → po-discovery, gated-reach → threat-modeling. This is a tier-metadata backfill backlog on the LINKED-TO skills, not a broken link. The one genuinely dangling link revealed by the same repair (competitive-positioning → a non-existent ../analyze-reference-repo/SKILL.md; it is a command, not a skill) was FIXED in the repairing commit rather than baselined. Clearing this entry means backfilling `tier` on the linked-to skills, or deciding that `tier: unset` on a link target is not a violation and narrowing the rule."
+    },
+    "lint_pack_boundaries": {
+      "count": 337,
+      "landed": "2026-08-02",
+      "note": "Markdown links between source artefacts that cross a pack boundary the source pack's `requires` graph does not reach — revealed when the scan root moved off the deleted packages/ tree to the live corpus (0 -> 753 artefacts scanned). 82 distinct pack pairs across 131 source files; largest single class is engineering-base -> meta (73), skills in a consumer-installable pack citing this package's own maintenance skills. Each is a link that dangles for a consumer who installs the source pack without the target's. Judged real drift rather than an over-strict gate because it is long-tailed — top bucket 22%, no single systematic cause — unlike the lint_artefact_frontmatter case, where one required shape had 0-of-288 adoption. Fix per finding: add the edge to packs.yml requires, retarget the link, or move the artefact."
+    }
+  }
+}