@event4u/agent-config 9.16.0 → 9.18.0

package/src/config/agent-settings.template.yml

@@ -321,6 +321,28 @@ personal:
   # See user-types/README.md for the per-id contract.
   user_type: "__USER_TYPE__"
 
+# --- Reply verbosity ---
+verbosity:
+  # Announce intent before tool batches ("Let me check X…") — only honored
+  # when personal.play_by_play is ALSO true (the direct-answers narration
+  # carve-out requires both). Default false = no intent narration.
+  intent_announcements: false
+
+  # Show generated commit messages, PR titles/bodies, branch names before
+  # acting. false = use generated content directly (/commit terse path).
+  preview_artifacts: false
+
+  # Confirmation prompts for routine workflow steps with one obvious answer.
+  # Iron-Law gates (commit-policy, scope-control git-ops, Hard Floor) ALWAYS
+  # ask regardless of this setting.
+  routine_confirmations: false
+
+  # Offer "run AI Council on this?" inside delivery commands.
+  offer_council_in_delivery: false
+
+  # Status blocks after a successful action: off | minimal | full.
+  post_action_reports: minimal
+
 # --- Project / team preferences ---
 project:
   # Path to the PR template file (relative to project root)
@@ -528,6 +550,52 @@ roadmap:
   # only if your team genuinely commits work on a calendar plate.
   horizon_weeks: 0
 
+# --- Plan governance gates ---
+#
+# Three governance gates around the plan/delivery workflow (contract:
+# docs/contracts/plan-review-gates.md). Scope is every plan artifact —
+# roadmaps AND feature plans — which is why these keys do not live under
+# `roadmap:`. All three default to true; a missing key behaves as true.
+planning:
+  # Gate C — plan-confidence gate, BEFORE authoring (true, false).
+  # true  = default. A plan-artifact authoring ask (/roadmap:create,
+  #         roadmap-writing, /feature:plan, /feature:roadmap) first runs
+  #         the four 95%-confidence conditions from /challenge-me vision.
+  #         All four hold → the agent creates directly and emits exactly
+  #         one marker line ("Confidence ≥ 95% — creating directly").
+  #         Any gap → the ask routes into the /challenge-me vision
+  #         interview first; hosts without that command run the inline
+  #         degrade interview (one question per turn, same stop
+  #         conditions — contexts/execution/plan-confidence-gate.md).
+  #         An explicit user bypass ("just write it") wins for that turn
+  #         and is counted (gate_c_bypass_rate).
+  # false = inert; plan asks author directly (today's behavior).
+  challenge_on_create: true
+
+  # Gate R1 — plan-risk review at plan creation / substantial change
+  # (true, false).
+  # true  = default. Every ready (non-draft) plan carries a schema-valid
+  #         `## Risk Register` section (ranked risks, mitigation +
+  #         in-document anchor per row, freshness marker). Enforced by
+  #         lint_plan_risk_register at pre-push + CI; drafts are exempt
+  #         until flipped to ready. Honest-null: an empty register is
+  #         valid only with the exact marker grammar from the contract.
+  # false = escape hatch; the validator skips (governance default is on).
+  risk_review: true
+
+  # Gate R2 — completion review at 100% roadmap completion / pre-PR
+  # (true, false).
+  # true  = default. A findings-BEFORE-fixes review by a fresh reviewer
+  #         context: the findings artifact (agents/evidence/reviews/…) must exist
+  #         for the current diff hash before the first fix commit; every
+  #         finding ends fixed | accepted-risk | deferred. No code
+  #         surface → explicit skip declaration, never a silent skip.
+  #         Enforced by check_completion_review at pre-push + CI (CI
+  #         authoritative); a crashed validator (exit 2) warns and
+  #         allows — a broken gate never blocks its own fix.
+  # false = escape hatch; the validator skips (governance default is on).
+  completion_review: true
+
 # --- Quality / CI execution ---
 #
 # Controls whether the agent runs the project's quality pipeline

package/src/config/evaluator-budgets.json

@@ -8,7 +8,9 @@
         "on_release": "fail",
         "on_main_and_prs": "warn",
         "on_local": "fail",
-        "always_blocking": ["a metric with no measurement supplied"],
+        "always_blocking": [
+            "a metric with no measurement supplied"
+        ],
         "rationale": "road-to-gates-that-can-fail Phase 5. A hard fail on main turns every legitimate command addition into a blocked merge, which is how budgets get quietly raised with a cushion instead of consciously — so budget / regression / drift findings are ADVISORY on main, the nightly and ordinary PRs, and BLOCKING on a release ref. Not a weakening: before the Phase-4 path triggers, this gate ran on release PRs and the nightly only, so the surfaces that now warn never saw it at all. A LOCAL run (no CI env) is strict, because a maintainer running it by hand — including release.ts — wants the strict answer and blocks nobody. A metric with NO measurement is always blocking in either posture: that is a broken harness reporting green on nothing. Implemented in src/scripts/check_evaluator_budgets.ts::detectPosture; override with --posture warn|fail.",
         "delivery": "This posture IS the nightly-visibility route (council 2026-08-02, blocker nightly-visibility-owner), not a second mechanism beside it: the nightly publishes measurement_record below, a later run re-measures and compares, and the contradiction warns on main / fails on release. No notification channel, no auto-managed issue — a one-maintainer channel producing routine noise gets muted, and a muted channel reproduces the original failure."
     },
@@ -25,13 +27,8 @@
         },
         "not_re_measured": "unpacked_size_mb, node_modules_mb, runtime_dep_count, cli_version_cold_ms, mcp_boot_to_initialize_ms. All five require the packed-tarball harness (npm pack of a fully built tree, then a clean `npm install --omit=dev <tarball>` into a scratch project) that evaluator_umbrella.sh runs in CI. They were NOT re-measured in this pass and their values remain the 2026-07-27 acceptance numbers — stated rather than invented. The next nightly writes the real numbers into measurement_record, and the drift check then reports any contradiction with last_measured on the PR that carries it."
     },
+    "removed_2026_08_04": "unpacked_size_mb (max 28) — removed by maintainer decision at the 9.17.0 release: the gate turned every legitimate payload addition into a blocked release (measured 28.22 vs max 28 with all functional gates green), and the maintainer judged tarball size not worth gating. evaluator_umbrella.sh still MEASURES and records unpacked_size_mb as evidence; only the budget enforcement is gone. ADR-204 review_trigger (a) fired and was resolved this way.",
     "budgets": {
-        "unpacked_size_mb": {
-            "max": 28,
-            "last_measured": 26.05,
-            "last_measured_at": "2026-07-27",
-            "method": "npm pack --json → dist.unpackedSize / 1e6 — includes the Phase-1 precompiled bundles (dist/hooks/dispatch.js + dist/mcp/server.mjs, ~2.1 MB) that bought the 23x hook-latency win and the tsx removal, plus dist/cli-delegate/ (~1.40 MB, ADR-204) which finished that removal for the consumer command surface. This gate is the ONLY size trip-wire on those bundles by design: a dedicated per-bundle budget key would need its own measurement wired into evaluator_umbrella.sh, and an unwired key fails check_evaluator_budgets with 'no measurement supplied' instead of guarding anything. ADR-204 projected 27.45 against max 28 without packing — the next real measurement here is the confirming one, and headroom is thin"
-        },
         "node_modules_mb": {
             "max": 140,
             "last_measured": 127,
@@ -61,11 +58,11 @@
             "deterministic": false
         },
         "cli_help_command_count": {
-            "max": 81,
-            "last_measured": 81,
-            "last_measured_at": "2026-08-03",
+            "max": 84,
+            "last_measured": 84,
+            "last_measured_at": "2026-08-04",
             "method": "registry enumeration — count of `{ name: '...', disposition` entries in src/cli/registry.ts (NOT --help prose parsing; methods historically disagreed 74 vs 76 vs 79)",
-            "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR."
+            "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84."
         },
         "mcp_public_tool_count": {
             "max": 19,

package/src/config/gate-coverage.yml

@@ -84,6 +84,12 @@
 # contract is `dist == rewrite(src)`; `check_ci_local_parity`, whose corpus is
 # workflow files) carries no recipe and is reported UNPROVEN, never green.
 gates:
+  - id: lint_trigger_collisions
+    argv: []
+    min_scanned: 90
+    corpus: "src/rules/*.md frontmatters (111 at baseline)"
+    status: enforced
+
   - id: check_condensation
     argv: []
     min_scanned: 380
@@ -260,6 +266,36 @@ gates:
       failure direction was false-positive rather than false-green, but the
       cause was the same dead root.
 
+  - id: lint_abstraction_thresholds
+    argv: []
+    min_scanned: 400
+    corpus: "src/rules + src/skills + src/agent-src/commands + docs/guidelines .md (533 at baseline)"
+    status: enforced
+    note: >
+      A collapse below the floor would mean the gate stopped reading the tree
+      that states extraction thresholds, so a bare or diverging threshold
+      (ADR-213 drift) could land while the gate still printed green.
+
+  - id: lint_profile_personas
+    argv: []
+    min_scanned: 5
+    corpus: "src/agent-src/profiles/*.yml (6 seed profiles at baseline)"
+    status: enforced
+    note: >
+      Fewer than 5 profiles scanned would mean the gate stopped reading the
+      seed-profile dir, so a defaults.personas id that resolves to no persona
+      file could land while the gate still printed green.
+
+  - id: lint_token_budget_discipline
+    argv: []
+    min_scanned: 200
+    corpus: "src/skills/*/SKILL.md (288 at baseline)"
+    status: enforced
+    note: >
+      A collapse below the floor would mean the gate stopped reading the skills
+      tree, so a rich-tagged skill without its justification section (or a cap
+      breach) could land while the gate still printed green.
+
   - id: lint_framework_leakage
     argv: []
     min_scanned: 350
@@ -272,3 +308,37 @@ gates:
       count. Its inventory-file exemption was also dead: it compared against
       the retired root AND against 'dist/agent-src' as a single path segment,
       which a '/'-split can never yield.
+
+  - id: lint_plan_risk_register
+    argv: []
+    min_scanned: 12
+    corpus: "ready roadmap files under agents/roadmaps/ top level (19 at baseline: 14 grandfathered + 4 draft-exempt + 1 carrying a live register)"
+    status: enforced
+    note: >
+      Gate R1 (docs/contracts/plan-review-gates.md § 1). The count is READY
+      FILES INSPECTED incl. grandfathered/draft-exempt ones — exemptions are
+      reported, never silently skipped, so a collapse below the floor means
+      the roadmaps root moved, not that the corpus went clean.
+
+  - id: check_completion_review
+    argv: ["--advisory", "--base", "origin/main"]
+    min_scanned: 1
+    corpus: "findings artefacts under agents/evidence/reviews/ + the current-diff evaluation (1 at baseline — the evaluation itself; artefact count grows with gated PRs)"
+    status: enforced
+    note: >
+      Gate R2 (docs/contracts/plan-review-gates.md § 2). HONEST LIMIT, stated
+      because a floor that cannot fail is exactly the false green this file
+      exists to prevent: scanned = artefacts inspected + 1 for the diff
+      evaluation, so it is >= 1 by construction and `min_scanned: 1` can never
+      trip. NOTHING ELSE TRIPS EITHER DURING THE ADVISORY WINDOW. The argv above
+      mirrors the CI invocation, and under `--advisory` every violation kind —
+      dead-scan-scope included — is printed as a warning and the exit code is 0.
+      So for the duration of the Stage-A window this entry proves only that the
+      gate RAN: it has no blocking path and no trippable floor. The blocking
+      behaviour is real but dormant — the dead-scan-scope assertion is a policy
+      violation, exit 1 (contract § 6 carve-out: a gate that read nothing has not
+      passed), which is what makes a moved reviews root fail loudly instead of
+      reporting a clean scope. It takes effect when Stage B drops `--advisory`
+      from the CI invocation; nothing else changes at that switch. The entry
+      stays registered so the guard reports this gate rather than skipping it
+      silently.

package/src/scripts/_cli/cmd_explain.ts

@@ -61,6 +61,8 @@ import {
     load_agent_settings,
     resolve_project_root,
 } from '../_lib/agent_settings.js';
+import { trigger_matches } from '../_lib/router_match.js';
+import type { Trigger } from '../_lib/router_match.js';
 import * as presets from '../config/presets.js';
 import * as profiles from '../config/profiles.js';
 import { build_trace } from './explain_last/index.js';
@@ -410,52 +412,51 @@ function pyReprAny(value: unknown): string {
     return String(value);
 }
 
-function _matches_trigger(trigger: Dict, text: string, lowered: string): string | null {
-    if ('keyword' in trigger) {
-        const kw = String(trigger['keyword']).toLowerCase();
-        if (kw && lowered.includes(kw)) {
-            return `keyword: ${kw}`;
+/** `kind: value` label for a trigger's single match key. */
+function _trigger_reason(trigger: Dict): string {
+    for (const kind of ['keyword', 'phrase', 'command', 'path_prefix', 'file_pattern']) {
+        if (kind in trigger) {
+            return `${kind}: ${String(trigger[kind])}`;
         }
     }
-    if ('phrase' in trigger) {
-        const ph = String(trigger['phrase']).toLowerCase();
-        if (ph && lowered.includes(ph)) {
-            return `phrase: ${ph}`;
-        }
-    }
-    if ('path_prefix' in trigger) {
-        const prefix = String(trigger['path_prefix']);
-        if (prefix && text.includes(prefix)) {
-            return `path_prefix: ${prefix}`;
-        }
-    }
-    return null;
+    return `trigger: ${JSON.stringify(trigger)}`;
 }
 
 function _explain_route(project_root: string, text: string, as_json: boolean): number {
     const router = _load_router(project_root);
-    const lowered = text.toLowerCase();
-    const matches: Dict[] = [];
-    const tier_1 = (router['tier_1'] as Dict[] | undefined) || [];
-    for (const entry of tier_1) {
-        const triggers = (entry['triggers'] as Dict[] | undefined) || [];
-        for (const trig of triggers) {
-            const reason = _matches_trigger(trig, text, lowered);
-            if (reason !== null) {
-                matches.push({ id: entry['id'], tier: 'tier_1', reason });
-                break;
+    // Matching goes through the SHARED matcher (_lib/router_match) — anchored
+    // keyword semantics, both tiers. This surface carries no open-files /
+    // command context, so path_prefix / file_pattern / command triggers
+    // cannot match here (previously path_prefix was probed against the
+    // prompt TEXT — a divergent second matcher, removed on purpose).
+    const tier_1_matches: Dict[] = [];
+    const tier_2_matches: Dict[] = [];
+    for (const [tier, sink] of [
+        ['tier_1', tier_1_matches],
+        ['tier_2', tier_2_matches],
+    ] as Array<[string, Dict[]]>) {
+        const rules = (router[tier] as Dict[] | undefined) || [];
+        for (const entry of rules) {
+            const triggers = (entry['triggers'] as Dict[] | undefined) || [];
+            for (const trig of triggers) {
+                if (trigger_matches(trig as Trigger, text, null, null)) {
+                    sink.push({ id: entry['id'], tier, reason: _trigger_reason(trig) });
+                    break;
+                }
             }
         }
     }
+    const total = tier_1_matches.length + tier_2_matches.length;
     const kernel_always = [...((router['kernel'] as unknown[] | undefined) || [])];
     const payload: Dict = {
         input: text,
         kernel_always,
-        tier_1_matches: matches,
+        tier_1_matches,
+        tier_2_matches,
     };
     if (as_json) {
         _dumpJson(payload);
-        return 0;
+        return total === 0 ? 1 : 0;
     }
     print(`  input: ${pyReprStr(text)}`);
     print();
@@ -464,14 +465,19 @@ function _explain_route(project_root: string, text: string, as_json: boolean): n
         print(`    · ${pyStr(kid)}`);
     }
     print();
-    print(`  tier-1 matches (${matches.length}):`);
-    if (matches.length === 0) {
-        print('    · (no trigger matched — only kernel rules active)');
-        return 1;
+    print(`  tier-1 matches (${tier_1_matches.length}):`);
+    for (const match of tier_1_matches) {
+        print(`    · ${match['id']}  (${match['reason']})`);
     }
-    for (const match of matches) {
+    print();
+    print(`  tier-2 matches (${tier_2_matches.length}):`);
+    for (const match of tier_2_matches) {
         print(`    · ${match['id']}  (${match['reason']})`);
     }
+    if (total === 0) {
+        print('    · (no trigger matched — only kernel rules active)');
+        return 1;
+    }
     return 0;
 }
 
@@ -757,7 +763,6 @@ export {
     _explain_config,
     _find_rule,
     _explain_rule,
-    _matches_trigger,
     _explain_route,
     _explain_last,
     _LAST_HELP,