@event4u/agent-config 9.16.0 → 9.18.0

package/dist/agent-src/rules/domain-safety-disclaimer.md

@@ -11,9 +11,10 @@ triggers:
   - keyword: "symptoms"
   - keyword: "dosage"
   - keyword: "medication"
+  # `valuation` / `DCF` moved to finance-safety-floor (2026-08-04) — that
+  # pack floor already carried both; this rule keeps the advisory-shaped
+  # finance triggers the floor does not cover.
   - keyword: "investment memo"
-  - keyword: "valuation"
-  - keyword: "DCF"
   - keyword: "tax position"
   - keyword: "strategic recommendation"
   - keyword: "board memo"
@@ -39,6 +40,8 @@ applies_to_user_types:
   - "creator"
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
+collision_ok:
+  "review this contract": "contract review is advisory-shaped — the not-legal-advice footer floor"
 ---
 
 # Domain Safety — Advisory Disclaimer

package/dist/agent-src/rules/domain-safety-pii.md

@@ -127,7 +127,7 @@ k-anonymity rule of thumb: combinations of {birth date, ZIP/postal code, gender}
 | Internal analyst, BYO-device, cloud analytics | Pseudonymized + aggregated only |
 | External partner, signed DPA | Pseudonymized + minimum-necessary columns |
 | External partner, no DPA | Refuse; require DPA first |
-| Public dataset | Aggregated, k-anonymity ≥ 5, no quasi-identifier combos |
+| Public dataset | Aggregated, k-anonymity ≥ 5 as the release floor, no quasi-identifier combos — a stricter bar (k ≥ 50) applies before *classifying* a metric as anonymous, per [`data-handling-judgment`](../skills/data-handling-judgment/SKILL.md) |
 
 ## Surface 4 — Legal privilege markers (legal pack)
 

package/dist/agent-src/rules/engineering-safety-floor.md

@@ -26,6 +26,8 @@ routes_to:
   - "skill:threat-modeling"
 workspaces: [engineering]
 packs: [engineering-base]
+collision_ok:
+  "migration": "a prod migration is a hard-floor evidence surface (rollback path, blast radius)"
 ---
 
 # Engineering Safety Floor

package/dist/agent-src/rules/framework-neutrality-in-generic-skills.md

@@ -34,6 +34,15 @@ workspaces: [agent-config-maintainer]
 packs: [meta]
 enforced_by:
   - "validator:src/scripts/lint_framework_leakage.ts"
+collision_ok:
+  "src/skills/": "generic skills must not mandate a stack — fires on skill edits"
+  "src/rules/": "rule edits are checked for framework leakage"
+  "src/agent-src/commands/": "command edits are checked for framework leakage"
+  "artisan": "artisan named in a generic artifact is leakage — the lint surface"
+  "eloquent": "eloquent named in a generic artifact is leakage — the lint surface"
+  "formrequest": "FormRequest named in a generic artifact is leakage — the lint surface"
+  "phpstan": "phpstan named in a generic artifact is leakage — the lint surface"
+  "rector": "rector named in a generic artifact is leakage — the lint surface"
 ---
 
 # framework-neutrality-in-generic-skills

package/dist/agent-src/rules/image-likeness-and-rights.md

@@ -18,6 +18,10 @@ applies_to_user_types:
 self_contained: true
 workspaces: [agent-config-maintainer, engineering, gtm]
 packs: [ai-image]
+collision_ok:
+  "/image:": "rights/likeness gate on the image-generation surface"
+  "likeness": "its own core subject — the rights gate"
+  "scripts/ai-image/adapters/": "adapter edits touch the likeness-gated generation path"
 ---
 
 # Image Likeness and Rights

package/dist/agent-src/rules/improve-before-implement.md

@@ -16,6 +16,10 @@ validator_ignore:
     reason: "Rule cites the authoring tree when describing where examples live."
 workspaces: [engineering]
 packs: [engineering-base]
+collision_ok:
+  "migration": "a migration is a significant behavioural change — the pre-implementation checks apply"
+  "refactor": "refactor = significant change; the demand gate + three checks apply"
+  "implement": "its own core trigger — pre-implementation validation"
 ---
 
 # Improve Before Implement

package/dist/agent-src/rules/laravel-routing.md

@@ -16,6 +16,10 @@ trust:
 install:
   default: false
   removable: true
+collision_ok:
+  "artisan": "artisan is a Laravel-flavoured PHP routing cue — load the laravel skill"
+  "eloquent": "eloquent is a Laravel routing cue"
+  "formrequest": "FormRequest is a Laravel routing cue"
 ---
 
 # Laravel Routing

package/dist/agent-src/rules/legal-safety-floor.md

@@ -28,6 +28,9 @@ packs: [legal-review-prep]
 trust:
   level: advisory
   human_review_required: true
+collision_ok:
+  "controller": "'controller' is a GDPR role term (controller/processor) in the legal pack"
+  "review this contract": "the legal-pack contract-review gate — both floors must fire"
 ---
 <!-- agent-config:human-review-banner -->
 > HUMAN REVIEW REQUIRED · trust: advisory · owner: unknown

package/dist/agent-src/rules/lethal-trifecta-guard.md

@@ -17,6 +17,9 @@ workspaces: [engineering]
 packs: [engineering-base]
 enforced_by:
   - "validator:src/scripts/lint_skill_frontmatter_safety.ts"
+collision_ok:
+  "src/skills/": "skill authoring reviews tool grants and the egress leg"
+  "src/agent-src/commands/": "command authoring reviews the three trifecta legs"
 ---
 
 # Lethal-Trifecta Guard

package/dist/agent-src/rules/media-governance-routing.md

@@ -31,6 +31,11 @@ workspaces: [agent-config-maintainer, engineering, gtm]
 packs: [ai-image, ai-video]
 enforced_by:
   - "validator:src/scripts/lint_media_policy_linkage.ts"
+collision_ok:
+  "/image:": "routes the project-local media policy layer on the same surface"
+  "/audio:": "routes the media policy layer for audio surfaces"
+  "/video:": "routes the media policy layer for video surfaces"
+  "likeness": "likeness prompts must load the policy layer before generation"
 ---
 
 # Media Governance Routing

package/dist/agent-src/rules/minimal-safe-diff.md

@@ -15,6 +15,8 @@ workspaces: [engineering]
 packs: [engineering-base]
 enforced_by:
   - "hook:minimal-safe-diff"
+collision_ok:
+  "fix": "a fix is the smallest change that solves the stated problem"
 ---
 
 # Minimal Safe Diff

package/dist/agent-src/rules/no-roadmap-references.md

@@ -20,6 +20,8 @@ packs: [meta]
 enforced_by:
   - "validator:src/scripts/check_no_roadmap_refs.ts"
   - "validator:src/scripts/check_council_references.ts"
+collision_ok:
+  "agents/roadmaps/": "roadmap edits are where transient-ref links get written"
 ---
 
 # No Transient References from Stable Artifacts

package/dist/agent-src/rules/notes-first-reasoning.md

@@ -15,6 +15,8 @@ routes_to:
   - "skill:memory-consolidation"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+collision_ok:
+  "debug": "debug hypotheses belong in the session notes file"
 ---
 
 # Notes-First Reasoning

package/dist/agent-src/rules/output-discipline.md

@@ -42,8 +42,15 @@ in a broken state:
 | `[Your component here]` / `<YourComponentName>` | Use the actual component name or write the component |
 | `Lorem ipsum` / `dolor sit amet` in UI output intended for review | Use realistic placeholder content or ask for content |
 
-The banned patterns above are also detected by `lint_output_slop.ts` (see
-`src/scripts/lint_output_slop.ts`) — violations cause a CI exit-code-2.
+A subset of the banned patterns is detected by `lint_output_slop.ts` (see
+`src/scripts/lint_output_slop.ts`) — Lorem-ipsum filler, bracket placeholders,
+`// rest of component` / `// ... (unchanged)`-style implementation
+placeholders, "for brevity" in code, standalone Unicode `…` lines, and
+`// TODO … implement` stubs — violations cause a CI exit-code-2. Three rows
+are NOT linter-detected (`/* similar pattern */`, `// rest follows same
+pattern`, ASCII `...`), and the linter scans only the suite's authored
+markdown (`src/skills/`, `src/rules/`, `docs/guidelines/`) as a backstop; for
+generated output the ban itself is model-carried.
 
 ## On budget overflow — PAUSED protocol
 

package/dist/agent-src/rules/php-coding.md

@@ -16,6 +16,8 @@ trust:
 install:
   default: false
   removable: true
+collision_ok:
+  "phpstan": "phpstan findings are the PHP pattern floor's own quality surface"
 ---
 
 # Php Coding

package/dist/agent-src/rules/prefer-enums-over-literals.md

@@ -12,6 +12,9 @@ triggers:
 self_contained: true
 workspaces: [engineering]
 packs: [engineering-base]
+collision_ok:
+  "migration": "migrations add columns — multi-state fields should land as enums from the start"
+  "category": "a category field is the canonical enum candidate"
 ---
 
 # Prefer Enums Over Literal Values

package/dist/agent-src/rules/provider-lifecycle-discipline.md

@@ -25,6 +25,11 @@ applies_to_user_types:
   - "maintainer"
 workspaces: [agent-config-maintainer, engineering, gtm]
 packs: [ai-image, ai-video]
+collision_ok:
+  "/image:": "provider-tier gate fires on the same generation surface"
+  "/audio:": "provider-tier gate for audio providers"
+  "/video:": "provider-tier gate for video providers"
+  "scripts/ai-image/adapters/": "adapter edits are the lifecycle contract's surface"
 ---
 
 # Provider Lifecycle Discipline

package/dist/agent-src/rules/roadmap-ci-steps-policy.md

@@ -28,6 +28,8 @@ self_contained: true
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
 roles: [planner]
+collision_ok:
+  "agents/roadmaps/": "roadmap steps must not schedule CI-shaped gates"
 ---
 
 # Roadmap CI-Steps Policy

package/dist/agent-src/rules/roadmap-progress-sync.md

@@ -14,6 +14,8 @@ packs: [meta]
 roles: [planner]
 enforced_by:
   - "hook:roadmap-progress"
+collision_ok:
+  "agents/roadmaps/": "any roadmap touch regenerates the dashboard, same response"
 ---
 
 # Roadmap Progress Sync

package/dist/agent-src/rules/rule-type-governance.md

@@ -8,6 +8,8 @@ routes_to:
   - "guideline:agent-infra/rule-type-governance"
 workspaces: [agent-config-maintainer]
 packs: [meta]
+collision_ok:
+  "src/rules/": "the always-vs-auto choice fires on every rule edit"
 ---
 
 # Rule Type Governance

package/dist/agent-src/rules/scale-discipline.md

@@ -23,6 +23,9 @@ workspaces: [engineering]
 packs: [scale-discipline]
 trust:
   level: professional
+collision_ok:
+  "migration": "R-A6 migration-safety owns reversibility/index/retention rules"
+  "schema": "schema change routes the persistence pack floor (R-A6/R-A2)"
 ---
 
 # Scale Discipline

package/dist/agent-src/rules/secret-vcs-guard.md

@@ -25,6 +25,8 @@ workspaces: [engineering]
 packs: [engineering-base]
 enforced_by:
   - "validator:src/scripts/check_secret_leak.ts"
+collision_ok:
+  "commit": "committing is the credential-leak moment this guard exists for"
 ---
 
 # Secret-in-VCS Guard

package/dist/agent-src/rules/security-sensitive-stop.md

@@ -3,13 +3,18 @@ type: "auto"
 tier: "2a"
 alwaysApply: false
 description: "Security-sensitive paths (auth, billing, tenants, secrets, uploads, webhooks) — threat-model BEFORE editing"
+# Trigger set disjoint from secret-vcs-guard by design (2026-08-04): bare
+# `secret` / `password` belong to the VCS-write surface (secret-vcs-guard);
+# this rule keeps the conversational security surface (editing auth/billing/
+# tenant/webhook paths and secrets *infrastructure*, not committing a
+# credential).
 triggers:
   - keyword: "auth"
   - keyword: "billing"
   - keyword: "tenant"
-  - keyword: "secret"
   - keyword: "webhook"
-  - keyword: "password"
+  - keyword: "oauth"
+  - keyword: "signing key"
 validator_ignore:
   - type: "substring"
     pattern: "../../docs/"
@@ -19,6 +24,8 @@ workspaces: [engineering]
 packs: [engineering-base]
 enforced_by:
   - "none"
+collision_ok:
+  "tenant": "tenancy is a threat-model-before-edit surface"
 ---
 
 # Security-Sensitive Stop Rule

package/dist/agent-src/rules/senior-engineering-discipline.md

@@ -19,6 +19,12 @@ routes_to:
   - "skill:testing-anti-patterns"
 workspaces: [engineering]
 packs: [engineering-base]
+collision_ok:
+  "migration": "migration = invisible-controls surface (reversible, indexed, tenant-scoped)"
+  "refactor": "a refactor must generalize, never overfit — the anchor applies"
+  "implement": "implementation = the invisible-controls checklist"
+  "endpoint": "endpoint row of the surface-to-controls table"
+  "component": "component work = generalize + reuse duty"
 ---
 
 # Senior Engineering Discipline

package/dist/agent-src/rules/skill-quality.md

@@ -10,6 +10,8 @@ workspaces: [agent-config-maintainer]
 packs: [meta]
 enforced_by:
   - "validator:src/scripts/skill_linter.ts"
+collision_ok:
+  "src/skills/": "every skill edit passes the executable-quality floor"
 ---
 
 # Skill Quality

package/dist/agent-src/rules/source-confidentiality.md

@@ -19,6 +19,10 @@ workspaces: [agent-config-maintainer]
 packs: [meta]
 enforced_by:
   - "validator:src/scripts/check_no_external_sources.ts"
+collision_ok:
+  "src/skills/": "skill prose must not name derivation sources"
+  "src/rules/": "rule prose must not name derivation sources"
+  "agents/roadmaps/": "harvest/comparison roadmaps stay anonymized"
 ---
 
 # Source Confidentiality

package/dist/agent-src/rules/source-discovery-gate.md

@@ -17,6 +17,9 @@ routes_to:
   - "skill:source-discovery"
 workspaces: [engineering]
 packs: [engineering-base]
+collision_ok:
+  "endpoint": "an unconfirmed endpoint shape needs evidence before code"
+  "schema": "a DB schema is the canonical structure to verify from a real source"
 ---
 
 # Source Discovery — evidence before structure

package/dist/agent-src/rules/source-of-truth.md

@@ -14,6 +14,8 @@ workspaces: [agent-config-maintainer]
 packs: [meta]
 enforced_by:
   - "validator:src/scripts/check_condensation.ts"
+collision_ok:
+  ".augment/": "the projection is read-only — edits belong in src/"
 ---
 
 # Source of Truth

package/dist/agent-src/rules/strategy-safety-floor.md

@@ -33,6 +33,8 @@ packs: [founder-strategy]
 trust:
   level: advisory
   human_review_required: true
+collision_ok:
+  "category": "'category' is positioning vocabulary (category design) in the strategy pack"
 ---
 <!-- agent-config:human-review-banner -->
 > HUMAN REVIEW REQUIRED · trust: advisory · owner: unknown

package/dist/agent-src/rules/think-before-action.md

@@ -17,6 +17,11 @@ triggers:
 self_contained: true
 workspaces: [engineering]
 packs: [engineering-base]
+collision_ok:
+  "refactor": "analyze-before-modify floor fires on any refactor"
+  "implement": "analyze-first floor on any implementation"
+  "debug": "targeted inspection over brute force while debugging"
+  "fix": "no blind trial-and-error on fixes — max 2 retries"
 ---
 
 # think-before-action

package/dist/agent-src/rules/token-budget-discipline.md

@@ -50,8 +50,8 @@ A skill claiming `rich` MUST satisfy ALL three:
    carry a `load_context` pointer instead.
 
 3. **≤ 15 % of the suite's skills may claim `rich`** — the CI linter counts
-   rich-tagged skills and hard-fails if the ratio is exceeded. With ~230 skills, the
-   cap is ~35. Do not claim `rich` for convenience; claim it only for
+   rich-tagged skills and hard-fails if the ratio is exceeded. With ~290 skills
+   (288 as-of 2026-08), the cap is ~43. Do not claim `rich` for convenience; claim it only for
    irreducible-complexity skills.
 
 ## Telegraph-speak amendment

package/dist/agent-src/rules/ui-audit-gate.md

@@ -14,6 +14,8 @@ routes_to:
   - "skill:typography-system"
 workspaces: [agent-config-maintainer, engineering]
 packs: [frontend-design]
+collision_ok:
+  "component": "no new component without audit findings — its core subject"
 ---
 
 # UI Audit Gate

package/dist/agent-src/rules/user-interaction.md

@@ -46,12 +46,11 @@ Mechanical backstop:
 (non-zero exit on any rule below). Self-scan is the primary gate;
 the script is the deterministic safety net.
 
-## Question pacing — simple vs complex
+## Question pacing — one decision point per turn
 
-- **Simple, binary, or independent questions** may be grouped into a single reply with numbered options.
-- **Complex, dependent, or branching questions** must be asked **one at a time** — one question per turn — so each answer informs the next.
+[`ask-when-uncertain`](ask-when-uncertain.md)'s Iron Law is canonical: **one question per turn**. What counts as "one question" is **one decision point** — a single numbered-options block is ONE question even when its options span multiple dimensions (a depth-and-framework matrix answered with a single number is one decision). Multiple separate asks in one reply, or a block whose answer would need a structured reply (`1a, 2b`), violate the kernel rule's self-check.
 
-If in doubt, prefer one question at a time over a long batched prompt.
+If in doubt, split into serial turns — never a long batched prompt.
 
 ## Mechanics — rationale, failure modes, format details, examples
 

package/dist/agent-src/skills/build-buy-partner/SKILL.md

@@ -70,7 +70,7 @@ Integration cost is the most under-counted number. For each option:
 2. **Buy** — vendor integration (weeks to first value) + ongoing change-management cost + lock-in (cost to switch off).
 3. **Partner** — boundary management + divergence cost (what happens when partner changes their roadmap?).
 
-A buy decision with 2-week integration is rare; budget 4–8 weeks for non-trivial integrations and 3–6 months for enterprise-grade ones.
+A buy decision with 2-week integration is rare; industry-typical ranges (public integration benchmarks — not a prediction of your timeline, per `direct-answers` § no duration estimates) run 4–8 weeks for non-trivial integrations and 3–6 months for enterprise-grade ones.
 
 ### Step 3: Inversion — name the failure mode for each option
 

package/dist/agent-src/skills/copilot-agents-optimization/SKILL.md

@@ -47,7 +47,7 @@ Only after this analysis, proceed with optimization.
 |---|---|
 | **Audience** | Augment Agent, other AI agents |
 | **Can read `.augment/`?** | ✅ Yes — can follow references |
-| **Line budget** | Max 1000, ideal ≤ 500 |
+| **Size budget** | ≤ 3,000 chars (package root; consumer template ≤ 2,500) — enforced by `lint_agents_md.ts`; see `size-and-scope.md` |
 | **Purpose** | Project-specific setup, Docker, testing, quality tools |
 
 **What belongs here:**
@@ -73,7 +73,7 @@ Only after this analysis, proceed with optimization.
 |---|---|
 | **Audience** | GitHub Copilot (Code Review bot + Chat) |
 | **Can read `.augment/`?** | ❌ Code Review cannot, ✅ Chat can |
-| **Line budget** | Max 1000, ideal ≤ 500 |
+| **Line budget** | < 150 lines (ideal < 60); Copilot Code Review reads only the first 4,000 chars |
 | **Purpose** | Coding standards, review rules, architecture constraints |
 
 **What belongs here:**
@@ -127,8 +127,8 @@ both. Instead, reference with a table:
 
 | File | 🟢 Good | 🟡 Warning | 🔴 Over budget |
 |---|---|---|---|
-| `AGENTS.md` | ≤ 500 | 501–800 | > 1000 |
-| `copilot-instructions.md` | ≤ 500 | 501–800 | > 1000 |
+| `AGENTS.md` | ≤ 2,800 chars | 2,801–3,000 chars | > 3,000 chars — `lint_agents_md.ts` fails (consumer template: warn 2,300 / fail 2,500) |
+| `copilot-instructions.md` | < 60 lines | 60–150 lines | > 150 lines, or key rules past the 4,000-char Copilot read window |
 
 ### Reduction strategies (when over budget)
 

package/dist/agent-src/skills/copilot-config/SKILL.md

@@ -197,7 +197,7 @@ Copilot and Augment complement each other:
 
 - copilot-instructions.md is for GitHub Copilot, NOT for Augment — don't mix audiences.
 - Don't duplicate .augment/ content into copilot-instructions.md — it bloats the file and causes drift.
-- Copilot reads the ENTIRE instructions file on every request — keep it under 500 lines.
+- Keep copilot-instructions.md under 150 lines (per `size-and-scope.md`) — Copilot Code Review reads only the first 4,000 characters, so put the highest-priority rules up top.
 
 ## Do NOT
 

package/dist/agent-src/skills/deep-reading-analyst/SKILL.md

@@ -49,11 +49,14 @@ Every framework module is a project-local guideline under `docs/guidelines/agent
 
 ### Step 1: Initialize Analysis
 
-Ask the user three things in **one** message (not three turns), per `ask-when-uncertain` Iron Law (one question per turn — these three are bundled into a single numbered-options block):
+Open with ONE decision point (per `ask-when-uncertain` — a single numbered-options block answerable with a single number is one question; never three separate asks):
 
-1. **Goal** — problem-solving · learning · writing · decision-making · curiosity.
-2. **Depth** — L1 Quick (15 min) · L2 Standard (30 min) · L3 Deep (60 min) · L4 Research (120 min+).
-3. **Framework override** — defaults are auto-suggested by content type (table below); user may name specific frameworks.
+1. **Standard read** — L2 depth, auto-selected frameworks (default).
+2. **Quick skim** — L1 depth, auto-selected frameworks.
+3. **Deep dive** — L3/L4 depth, auto-selected frameworks.
+4. **Custom** — name your goal (problem-solving · learning · writing · decision-making · curiosity), depth level, and/or specific frameworks in your reply.
+
+Depth levels are scope descriptors, not wall-clock promises (per `direct-answers` — no duration estimates): L1 skim · L2 standard · L3 deep · L4 exhaustive-research.
 
 If the user does not answer, default to L2 Standard with auto-selected frameworks.
 

package/dist/agent-src/skills/description-assist/SKILL.md

@@ -52,7 +52,7 @@ Normative source: [`skill-quality`](../../rules/skill-quality.md) § *Descriptio
 
 | Check | Pass when… |
 |---|---|
-| **Length** | ≤ 200 characters (soft cap; linter warns `description_too_long`) |
+| **Length** | ≤ 200 characters (hard cap; linter errors `description_too_long`) |
 | **Trigger prefix** | Starts with "Use when …" or equivalent trigger phrasing |
 | **Trigger classes** | Names ≥ 2 of: domain, symptom, user phrasing, tool, file type |
 | **Undertrigger tail** | Ends with "… even if the user doesn't say `{name}`" or equivalent |