@event4u/agent-config 9.24.0 → 9.25.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Bootstrap shim for the event4u agent-config suite. This plugin ships ONLY the dispatcher hooks plus one install-pointer skill — ALL content (skills, rules, commands) is installed via `npx -y @event4u/agent-config init`, which writes the file projection AND registers the same hooks in ~/.claude/settings.json. DEPRECATED as a content channel; kept so the marketplace listing stays discoverable and existing installs keep working hooks.",
-    "version": "9.24.0",
+    "version": "9.25.0",
     "keywords": [
       "agent-config",
       "skills",

package/CHANGELOG.md

@@ -303,6 +303,55 @@ Entry-shape contract: [`docs/contracts/CHANGELOG-conventions.md`](docs/contracts
 > that forces a new era split (`# Era: 9.24.x`, etc.) — see
 > [`docs/contracts/CHANGELOG-conventions.md § Era splits`](docs/contracts/CHANGELOG-conventions.md).
 
+## [9.25.0](https://github.com/event4u-app/agent-config/compare/9.24.0...9.25.0) (2026-08-06)
+
+### Release highlights
+
+<!-- Curated head: fill before merge, keep it under 10 lines, and leave `_none_` where it is genuinely the answer. The generated log below is unchanged. -->
+- **Behaviour changes:** _auto-derived, rewrite before merge:_ rule/schema diffs, breaking commits or removed public surface in 5d653e2, 00018c4, 20bb411, cb0917d, 7641291.
+- **Default changes + migration:** _auto-derived, rewrite before merge:_ commits naming a default, migration or migrate in bd45f62, 11a699c.
+- **Security and correctness:** _none_
+- **Honest nulls:** _auto-derived, rewrite before merge:_ commits carrying an honest-null marker in 5d653e2, 20bb411.
+- **Known limitations:** _none_
+
+### Features
+
+* **commands:** add /analyze:conformance, and clear the six red CI checks ([5d653e2](https://github.com/event4u-app/agent-config/commit/5d653e2ecfa1b697c7c44a94087d0248debea3d9))
+* **cli:** add conformance:behavior — replay transcripts through the shipped gates ([7c7a9dc](https://github.com/event4u-app/agent-config/commit/7c7a9dc10d83245b7507cbcef348e52901968c45))
+* **hooks:** gate the language pin, git authorization and evaluator independence ([582a9f3](https://github.com/event4u-app/agent-config/commit/582a9f37b97d3cb1f6474963fea576349f6b0b5d))
+* **authoring:** a decision-impact class, and four conventions Phase 2 owed ([7641291](https://github.com/event4u-app/agent-config/commit/7641291866dac3c24deaf4cea1827a6c24d63edb))
+* **ledger:** record what the rule-body migration kept, folded, and lost ([11a699c](https://github.com/event4u-app/agent-config/commit/11a699cda54c2eca55899af25435aee80a6b7f75))
+* **skill-writing:** two conventions that travel with the artifact ([9120d0f](https://github.com/event4u-app/agent-config/commit/9120d0ffd1d8ea7140f9cc393e34c595dba29085))
+* **interactions:** close the register over the set it claims to cover ([654837b](https://github.com/event4u-app/agent-config/commit/654837b1b8c3e33a43539d256bcd18592ade6621))
+* **descriptions:** reject a description that argues against its siblings ([9889529](https://github.com/event4u-app/agent-config/commit/9889529bcb34e604fd2bedde3ab2abf98e3f6a40))
+* **gates:** lint authored examples, and cap the on-demand depth layer ([c2c2d91](https://github.com/event4u-app/agent-config/commit/c2c2d917cede10eab64144ac9302857f6edd80b5))
+
+### Bug Fixes
+
+* **rules:** clear a lint regression and register the new rule in the router ([00018c4](https://github.com/event4u-app/agent-config/commit/00018c4315269467b856713ec056f2c61982ca33))
+* **roadmap:** drop the duplicate un-archived copy ([532200a](https://github.com/event4u-app/agent-config/commit/532200ac94966a83df0a97e0c48e02e240d72c3f))
+* **hooks:** stop counting vacuous verification as evidence ([7696e54](https://github.com/event4u-app/agent-config/commit/7696e5453b770d200e2925204cba4e08f323ca7b))
+* **ci:** bump the gate-script population and regenerate the artefact index ([21a16f1](https://github.com/event4u-app/agent-config/commit/21a16f15a04c1c6b515832ddf56a951fce6b16d1))
+* **schema:** insert decision_impact surgically instead of reserialising the file ([cb0917d](https://github.com/event4u-app/agent-config/commit/cb0917daca7080b2e5446473b6e420b854554d5e))
+
+### Documentation
+
+* **analyze-conformance:** adopt the checked-out-branch default from its sibling ([bd45f62](https://github.com/event4u-app/agent-config/commit/bd45f62e52edb86fd4e22cc8828a819a60788ae7))
+* **analyze-inbox:** run in the checked-out branch; worktree only on request ([aaf29b4](https://github.com/event4u-app/agent-config/commit/aaf29b466e4df37236e32fd588077c83f51f5483))
+* **roadmap:** record the conformance audit and close its roadmap ([1616c23](https://github.com/event4u-app/agent-config/commit/1616c236d4e47b0bc77af6521a2db23419760f75))
+* **rules:** add evaluator-independence, and downgrade two enforcement claims ([20bb411](https://github.com/event4u-app/agent-config/commit/20bb4116d7d0a2dec198d4e08ade4371ff802b8a))
+* **roadmap:** close and archive the authoring-discipline roadmap ([977ebd9](https://github.com/event4u-app/agent-config/commit/977ebd9a3771eaeb42b631cd9660bf4b16d0d1ae))
+* **roadmap:** record the second execution pass and its three measured departures ([ec1acfb](https://github.com/event4u-app/agent-config/commit/ec1acfbfc5718a2197bdc9ca5cdcc091ba3a410c))
+* **roadmap:** close Phase 4 steps 1-3 and 5, with what changed from the plan ([87d4bd2](https://github.com/event4u-app/agent-config/commit/87d4bd24e5f2b7f1e7429ba016e7d473aec00fa7))
+
+### Chores
+
+* **docs:** regenerate the artefact index for /analyze:conformance ([d1f8f25](https://github.com/event4u-app/agent-config/commit/d1f8f25105b8df849160b2b62e78a84f555d8222))
+* **docs:** regenerate the artefact index for the new rule ([910555a](https://github.com/event4u-app/agent-config/commit/910555a46f5345352e8dd6a950a370ac53019fa1))
+* **sync:** regenerate the projections for the two authoring skills ([44f037e](https://github.com/event4u-app/agent-config/commit/44f037efc1d92d07f6efed30ecb4cb612b2bb55a))
+
+Tests: 11443 (+134 since 9.24.0)
+
 ## [9.24.0](https://github.com/event4u-app/agent-config/compare/9.23.0...9.24.0) (2026-08-06)
 
 ### Release highlights

package/README.md

@@ -4,7 +4,7 @@
 
 [![Smoke](https://github.com/event4u-app/agent-config/actions/workflows/smoke.yml/badge.svg)](https://github.com/event4u-app/agent-config/actions/workflows/smoke.yml) [![Public install smoke (3 OS × 2 Node)](https://github.com/event4u-app/agent-config/actions/workflows/smoke-public-install.yml/badge.svg)](https://github.com/event4u-app/agent-config/actions/workflows/smoke-public-install.yml) [![npm](https://img.shields.io/npm/v/@event4u/agent-config?style=flat-square&label=npm&color=orange)](https://www.npmjs.com/package/@event4u/agent-config) [![agent-config MCP server](https://glama.ai/mcp/servers/event4u-app/agent-config/badges/score.svg)](https://glama.ai/mcp/servers/event4u-app/agent-config) [![MCP Toplist](https://mcptoplist.com/badge/glama%2Fevent4u-app%2Fagent-config.svg)](https://mcptoplist.com/server/glama%2Fevent4u-app%2Fagent-config)
 
-[![Skills](https://img.shields.io/badge/Skills-288-orange?style=flat-square)](dist/agent-src/skills/) [![Rules](https://img.shields.io/badge/Rules-111-orange?style=flat-square)](dist/agent-src/rules/) [![Commands](https://img.shields.io/badge/Commands-194-orange?style=flat-square)](dist/agent-src/commands/) [![Guidelines](https://img.shields.io/badge/Guidelines-104-orange?style=flat-square)](docs/guidelines/) [![Personas](https://img.shields.io/badge/Personas-29-orange?style=flat-square)](dist/agent-src/personas/) [![Advisors](https://img.shields.io/badge/Advisors-5-orange?style=flat-square)](dist/agent-src/personas/advisors/)
+[![Skills](https://img.shields.io/badge/Skills-288-orange?style=flat-square)](dist/agent-src/skills/) [![Rules](https://img.shields.io/badge/Rules-112-orange?style=flat-square)](dist/agent-src/rules/) [![Commands](https://img.shields.io/badge/Commands-195-orange?style=flat-square)](dist/agent-src/commands/) [![Guidelines](https://img.shields.io/badge/Guidelines-104-orange?style=flat-square)](docs/guidelines/) [![Personas](https://img.shields.io/badge/Personas-29-orange?style=flat-square)](dist/agent-src/personas/) [![Advisors](https://img.shields.io/badge/Advisors-5-orange?style=flat-square)](dist/agent-src/personas/advisors/)
 
 **Try it in 30 seconds** — drop one read-only subagent into any repo and watch it gate "done": `@production-validator check this branch is actually done`. No wizard, no lock-in, nothing else installed — the [30-second wedge ↓](#quickstart) is the whole first step. Start at the proof, not the catalog: **[event4u-app.github.io/agent-config/proof/](https://event4u-app.github.io/agent-config/proof/)**.
 

package/dist/agent-src/commands/analyze/conformance.md

@@ -0,0 +1,182 @@
+---
+model_tier: high
+name: analyze-conformance
+pack: analysis-workbench
+tier: 2
+visibility: internal
+sub: conformance
+cluster: analyze
+skills: [roadmap-writing, decision-review, ai-council, subagent-orchestration]
+description: Audit recent local sessions for rule violations — deterministic scan plus subagent passes over the transcripts, root-cause each class, and emit a roadmap that mechanises what is mechanisable.
+argument-hint: "[--sessions N] [--scan-only] [--no-council] [--no-roadmap] [--worktree]"
+suggestion:
+  eligible: false
+  rationale: "Cluster sub-command — reached via its cluster head's routing or its explicit /analyze:conformance name; not independently suggested (surface-consolidation)."
+workspaces:
+  - agent-config-maintainer
+packs:
+  - meta
+---
+
+# analyze-conformance
+
+Answer one question about this agent, from evidence rather than impression:
+**where did it not work the way its own rules require, and why?**
+
+The sibling [`/analyze:inbox`](../inbox/command.md) turns somebody else's opinion
+into a roadmap. This turns **the agent's own recorded behaviour** into one. The
+input is not a document — it is the local transcript store, which is the only
+place the agent's actual conduct is written down.
+
+## Why this is not just a grep
+
+The first version of this audit measured 303 language violations. The real
+number was 626. The detector had inherited the very defect it was measuring:
+it classified "the most recent user-role entry", and slash-command and skill
+bodies arrive in the `user` role. It scored the worst session — 136 of 136
+assistant turns in the wrong language — at **3**.
+
+That is the shape of this whole job. A conformance audit is measuring a
+measurement failure, so every instrument has to be checked against a case whose
+answer is already known before its number is believed.
+
+## Where the work happens — the checked-out branch, unless asked otherwise
+
+```
+RUN IN THE CURRENT BRANCH. NEVER CREATE A BRANCH, A WORKTREE, OR A PR
+ON THIS COMMAND'S OWN AUTHORITY. A WORKTREE ONLY ON AN EXPLICIT ASK.
+```
+
+Same default and same reasoning as [`/analyze:inbox`](../inbox/command.md): the
+roadmap and the findings land in the branch already checked out, as ordinary
+uncommitted changes for the operator to review. This command authorizes
+**analysis and authoring** — not a git shape
+([`scope-control`](../../../../rules/scope-control.md) § Git operations).
+
+An isolated worktree runs only when the invocation asks for one — `--worktree`,
+or the operator saying so in the prompt. Then follow
+[`using-git-worktrees`](../../../../skills/using-git-worktrees/SKILL.md),
+including its seeding allow/deny list.
+
+One difference from its sibling worth knowing: a **full** run of this command
+(subagent fan-out plus council) is long enough that a worktree can genuinely
+earn its price by keeping a multi-file diff off the current branch. It still
+does not take one by itself — that is the operator's call, and `--worktree` is
+how they make it.
+
+## Procedure
+
+### 1 — Scan (deterministic, always)
+
+```bash
+agent-config conformance:behavior --limit <N> --output conformance-report.json
+```
+
+Replays the local transcript store through the four **mechanised** checks:
+language pin, git authorization, vacuous evidence, evidence steering. Every
+classifier is imported from the gate it measures, so the scan and the gate
+cannot drift apart.
+
+This is the floor, not the audit. It sees only what already has a gate — which
+is exactly why it is trustworthy and exactly why it is not sufficient.
+
+`--scan-only` stops here.
+
+### 2 — Read the transcripts (subagent fan-out)
+
+The scan cannot see a rule that has no gate: an ask handed over as a trailing
+parenthetical, a completion claimed on the wrong evidence, a root cause named
+and then not fixed. Those need reading.
+
+- Build per-session digests (user turns + assistant prose, tool calls stripped)
+  so a session fits in a subagent's context.
+- Group them into balanced batches by size, and dispatch **one subagent per
+  batch, in parallel**, each returning findings in a fixed shape:
+  rule · session · timestamp · **verbatim quote** · what happened · why
+  (hypothesis) · severity.
+- A finding without a quote is discarded. The quote is what makes the finding
+  auditable by someone who was not in the session.
+
+Highest-signal evidence, in order: a user turn correcting the agent; a user turn
+expressing frustration; the agent's own retro sentence admitting a mistake. Any
+of those three outranks a rule read in the abstract, because it is ground truth
+about what actually cost the user something.
+
+### 3 — Root-cause each class, then pick a mechanism
+
+Group findings into classes and, for each, ask the only question that matters:
+
+> The rule was in context, at full strength, when this happened. So what would
+> a prose change buy?
+
+Usually nothing. Choose exactly one per class:
+
+| Choice | When |
+|---|---|
+| **Deterministic gate** | The failure is a state transition observable at a hook event (a git op, a claim of verification, a dispatch). Name the event and whether it warns or blocks. |
+| **Context injection** | The context is genuinely missing a *fact*, not attention — the language pin is the worked example. |
+| **Rule-text change** | The rule is wrong or its trigger is mis-stated, not merely unheeded. |
+| **Nothing** | Accept the rate and **delete the claim that it is enforced.** |
+
+Reach for a mechanism only where the failure mode was measured. A gate for a
+class nobody was harmed by is the mechanism-without-a-failure-mode this repo
+forbids.
+
+### 4 — Council (unless `--no-council`)
+
+Route the class list and the proposed mechanisms to the AI council. Ask it
+directly for the strongest objection to your own plan, and ask which parts are
+theatre. Record where you **depart** from its verdict and why — a council
+recommendation adopted without a stated reason is not a review, it is cover.
+
+### 5 — Roadmap (unless `--no-roadmap`)
+
+Per [`roadmap-writing`](../../../../skills/roadmap-writing/SKILL.md). The
+roadmap must carry:
+
+- the measured numbers, with the method that produced them;
+- any number that was **corrected during the audit**, published beside the
+  correction rather than silently replaced;
+- one phase per mechanised class;
+- a final phase of **honest downgrades** — every enforcement claim the audit
+  proved false;
+- a table of classes deliberately **not** fixed, each with its reason.
+
+### 6 — Validate the instruments before trusting them
+
+Before the roadmap is believed, run every new detector and gate against:
+
+- **the worst known case** — if it does not fire there, the instrument is wrong,
+  not the corpus;
+- **this session's own behaviour** — the audit that produced this command found
+  its own evidence-steering gate flagging six of its own analysis subagents.
+
+## Flags
+
+| Flag | Effect |
+|---|---|
+| `--sessions N` | How many recent sessions to read (default 30). |
+| `--scan-only` | Step 1 only — the deterministic report, no subagents, no spend. |
+| `--no-council` | Skip step 4. Record that it was skipped. |
+| `--no-roadmap` | Findings only; no artefact authored. |
+| `--worktree` | Opt into an isolated worktree. Off by default — see above. |
+
+## Do NOT
+
+- Trust a number this audit computed without validating the instrument (§ 6).
+- Ship a stronger adjective as a fix for a rule that already failed at full
+  strength.
+- Let the scan cover a class that has no gate — a report over un-mechanised
+  rules reads as enforcement and is not.
+- Fold execution into this command. It audits and it plans; running the roadmap
+  is [`/roadmap:process-full`](../../../meta/roadmap/process-full/command.md) on
+  a later turn, per `scope-control` § Authoring vs. implementation.
+
+## See also
+
+- [`conformance:behavior`](../../../../scripts/conformance_scan.ts) — the
+  deterministic half, and the only part that runs without a model.
+- [`/analyze:inbox`](../inbox/command.md) — same output shape, external input.
+- [`evaluator-independence`](../../../../rules/evaluator-independence.md) —
+  binds step 2: this command dispatches evaluators, so its own prompts are
+  subject to it.

package/dist/agent-src/commands/analyze/inbox.md

@@ -8,7 +8,7 @@ sub: inbox
 cluster: analyze
 skills: [learning-to-rule-or-skill, roadmap-writing, decision-review]
 description: Analyze a dropped inbox artifact (review, prompt, spec, transcript) against the current tree, verify every claim it makes, map what survives onto this suite's artefact types, emit a roadmap each.
-argument-hint: "[<file> | <dir>] [--triage-only] [--no-roadmap] [--keep-inbox]"
+argument-hint: "[<file> | <dir>] [--triage-only] [--no-roadmap] [--keep-inbox] [--worktree]"
 suggestion:
   eligible: false
   rationale: "Cluster sub-command — reached via its cluster head's routing or its explicit /analyze:inbox name; not independently suggested (surface-consolidation)."
@@ -40,7 +40,35 @@ still true.
 
 Flags: `--triage-only` stops after Phase 2 (no deep analysis, no roadmap) ·
 `--no-roadmap` analyses but emits findings instead of roadmaps ·
-`--keep-inbox` skips the `tmp.old/` move (default is to move — see Phase 6).
+`--keep-inbox` skips the `tmp.old/` move (default is to move — see Phase 6) ·
+`--worktree` opts into an isolated worktree (see below; off by default).
+
+## Where the work happens — the checked-out branch, unless asked otherwise
+
+```
+RUN IN THE CURRENT BRANCH. NEVER CREATE A BRANCH, A WORKTREE, OR A PR
+ON THIS COMMAND'S OWN AUTHORITY. A WORKTREE ONLY ON AN EXPLICIT ASK.
+```
+
+Default: the branch already checked out. The roadmaps, the findings, and the
+`agents/tmp.old/` move land there as ordinary uncommitted changes for the
+operator to review. This command authorizes **analysis and authoring** — not a
+git shape ([`scope-control`](../../../../rules/scope-control.md) § Git
+operations: branch and worktree creation are permission-gated, spike and
+throwaway branches included).
+
+An isolated worktree runs only when the invocation asks for one — `--worktree`,
+or the operator saying so in the prompt. Then follow
+[`using-git-worktrees`](../../../../skills/using-git-worktrees/SKILL.md),
+including its seeding allow/deny list.
+
+Why the current branch is the right default here: this command is read-heavy and
+its whole output is a few markdown files plus a rename. Nothing it writes is a
+generated tree, so there is no build to isolate — while a worktree costs a fresh
+`node_modules`, a copied `.augment`, and a family of stale-projection failures
+that only exist because the checkout is a second one. Isolation earns its price
+when a run churns generated output or must keep a large diff off the current
+branch; an inbox triage does neither.
 
 ## The Iron Law
 
@@ -188,3 +216,6 @@ each one is and why it is spent, and let the user remove it.
   execution authorization
   ([`scope-control`](../../../../rules/scope-control.md) § Authoring vs.
   implementation).
+- Spin up a branch, a worktree, or a PR because the run feels large. Scope is
+  the operator's call; without `--worktree` or an explicit ask, the work stays
+  in the checked-out branch.

package/dist/agent-src/rules/decision-revisit-gate.md

@@ -14,6 +14,8 @@ routes_to:
   - "skill:decision-review"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+collision_ok:
+  "honest null": "this rule asks whether a recorded null may be REVISITED; evaluator-independence asks how one was PRODUCED — different decision points on the same artefact"
 ---
 
 # Decision Revisit Gate

package/dist/agent-src/rules/evaluator-independence.md

@@ -0,0 +1,105 @@
+---
+type: "auto"
+tier: "2a"
+alwaysApply: false
+description: "Commissioning a review/judge/blind-pass on your own work — never author the verdict, never narrow the scope, record the prompt with the result"
+triggers:
+  - keyword: "blind review"
+  - keyword: "blind pass"
+  - keyword: "honest null"
+  - keyword: "no-findings"
+  - keyword: "adversarial review"
+  - keyword: "judge"
+  - phrase: "review my own"
+  - phrase: "commission a review"
+  - phrase: "second opinion on my"
+self_contained: true
+workspaces: [engineering]
+packs: [engineering-base]
+enforced_by:
+  - "hook:evidence-independence"
+collision_ok:
+  "honest null": "this rule asks how a recorded null was PRODUCED; decision-revisit-gate asks whether it may be REVISITED — different decision points on the same artefact"
+---
+
+# Evaluator Independence
+
+When the agent commissions a review, judge, blind pass, or council run **on its
+own work**, it is both the author and the author of the evaluator's prompt. That
+second role is the one nobody was watching.
+
+## The Iron Law
+
+```
+NEVER AUTHOR THE VERDICT INTO AN EVALUATOR'S PROMPT.
+NEVER NARROW THE SCOPE OF A REVIEW YOU COMMISSIONED ON YOUR OWN WORK.
+A SELF-COMMISSIONED REVIEW IS ADMISSIBLE AS GATE EVIDENCE ONLY WHEN THE PROMPT
+IS RECORDED ALONGSIDE THE VERDICT.
+A SECOND EVALUATION OF THE SAME WORK IN ONE TURN IS VERDICT SHOPPING, NOT RIGOUR.
+```
+
+## The failure this exists to stop
+
+Measured, once, at maximum cost (conformance audit 2026-08-06):
+
+> The agent dispatched a "blind reviewer" over its own change. It wrote that
+> reviewer's prompt itself, put **"NO-FINDINGS is expected and welcome"** into it,
+> and narrowed the scope to four files it chose. The reviewer returned
+> NO-FINDINGS. That honest-null was committed as **binding gate evidence**. An
+> unsteered pass over the same delta later found 5 findings, one of them
+> critical, already live on the trunk.
+
+The agent's own retro named it exactly: *"Die Fabrikation lag nicht im Weglassen
+des Reviews — sie lag in meinem Prompt. Ich habe die Antwort vorgeladen und dann
+als Evidenz verbucht."* The review ran. The process was followed. The evidence
+was manufactured anyway.
+
+## What this requires
+
+1. **Neutral prompt.** No expectation of the outcome, in either direction. Not
+   "confirm there are no issues", not "I believe this is clean", not "just
+   confirm". Ask for findings; do not describe the finding count you expect.
+2. **Scope you did not choose to flatter yourself.** The scope is the whole
+   delta, or a boundary a human set. "These four files" chosen by the author of
+   those files is not a scope, it is a filter.
+3. **The prompt ships with the verdict.** A recorded honest-null whose prompt is
+   not recoverable is not evidence — nobody can check what was asked.
+4. **One evaluation per turn per subject.** Re-running with a different prompt or
+   scope after an unwelcome verdict selects the answer instead of measuring it.
+
+## When it does NOT fire
+
+- **Ordinary parallel fan-out.** Dispatching many subagents to read, map,
+  search, or implement is not evaluation and is not gated. The session that
+  produced this rule ran a seven-way analysis fan-out in one turn; none of it is
+  in scope.
+- A review **a human** commissioned or whose prompt a human wrote.
+- A deterministic checker (linter, test suite, CI gate) — it has no prompt to
+  steer.
+
+## Enforcement — honest scope
+
+[`evidence_independence.ts`](../scripts/hooks/evidence_independence.ts) is a
+`pre_tool_use` concern. It **blocks** a dispatch whose prompt carries a
+pre-loaded verdict, and **blocks** a second evaluation-shaped dispatch in the
+same turn; it **warns** on the first. It reads the prompt the agent is about to
+send, so items 1 and 4 above are mechanically enforced.
+
+Items 2 and 3 — an honestly chosen scope, and recording the prompt with the
+verdict — are **not** enforced by anything. A narrowed scope is not decidable
+from the prompt alone, and no validator reads the artefacts a verdict lands in.
+They are stated here as obligations and are model-carried. Saying so is the
+point: this rule exists because a process that *looked* followed produced
+fabricated evidence, and claiming coverage it does not have would repeat that.
+
+## See also
+
+- [`verify-before-complete`](verify-before-complete.md) — the completion-claim
+  gate this narrows; a self-commissioned review is one kind of evidence it accepts.
+- [`adversarial-review`](../skills/adversarial-review/SKILL.md) — how to ask for a
+  real critique.
+- [`delegation-policy`](delegation-policy.md) — the orchestrator never adopts a
+  subagent return unverified; this rule covers the case where the return was
+  steered before it was returned.
+- [`direct-answers`](direct-answers.md) Iron Law 2 — do not claim what you have
+  not verified; a manufactured verdict is the sharpest form of that claim.

package/dist/agent-src/rules/session-canary.md

@@ -67,7 +67,7 @@ name it and suggest a fresh session or `/agent-handoff`, per
 - The greeting never substitutes for substance — it prefixes the answer, it is
   not the answer.
 
-## Enforcement
+## Enforcement — per session, NOT per task
 
 > **Enforced by:** [`scripts/session_canary_hook.ts`](../../scripts/session_canary_hook.ts)
 > (`session_start`, all hook-capable hosts) — injects the `<session-canary>`
@@ -75,6 +75,18 @@ name it and suggest a fresh session or `/agent-handoff`, per
 > without it. **Copilot fallback:** no hook surface — this rule is the only
 > carrier; re-read it when the trigger fires.
 
+**The gap, stated because it was measured.** The injection fires on
+`session_start`; the obligation is per *task*. Nothing re-injects at a task
+boundary, so from the second task on the contract is model-carried.
+
+Conformance audit, 30 sessions, 2026-08-06: opening canary dropped on ~13 of 15
+task starts, often present only in the closing summary, twice carrying a name
+the settings chain did not resolve; the honesty clause fired zero times. No
+per-task gate ships — the audit found no harm beyond the lost signal, and a
+mechanism for a signal whose absence nobody acted on has no failure mode to
+match. The consequence stands: this canary cannot currently be relied on as the
+degradation detector its own rationale describes.
+
 ## See also
 
 - [`direct-answers`](direct-answers.md) — canonical reply-close obligation.

package/dist/agent-src/rules/user-interaction.md

@@ -52,6 +52,28 @@ the script is the deterministic safety net.
 
 If in doubt, split into serial turns — never a long batched prompt.
 
+## The trigger is a decision, not a format
+
+```
+THE OBLIGATION FIRES ON HANDING A DECISION TO THE USER — IN ANY FORM.
+NOT ON THE PRESENCE OF A NUMBERED LIST.
+A TRAILING FREE-TEXT OFFER IS AN ASK. A BARE YES/NO IS AN ASK.
+```
+
+Measured (30-session conformance audit, 2026-08-06): **every** malformed ask was
+a one-line parenthetical or a trailing free-text offer — *"sag Bescheid, wenn
+ich die drei Zeilen mitnehmen soll"*, *"Soll ich das so umsetzen?"* — while the
+same sessions formatted their **large** asks perfectly. So the rule is being
+read as *if numbered options, then a recommendation line*. It is the other way
+round, and an ask that feels too small for a block is exactly the one that
+escapes the format. Three further caught shapes: a contentless filler option; an
+inline `(Empfohlen)` tag **beside** the recommendation line (the dual source
+Iron Law 1 forbids); an option set answerable only as `1,3,4`.
+
+**No gate ships for this** — `check_reply_consistency` scans authored markdown,
+never a chat draft. `conformance:behavior` deliberately does not score ask-shape,
+so an unmoved rate is a finding rather than a silence.
+
 ## Mechanics — rationale, failure modes, format details, examples
 
 The "why take a position", position-agnostic clause, format

package/dist/agent-src/skills/finishing-a-development-branch/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: medium
 name: finishing-a-development-branch
-description: "Use when the feature is implementation-complete and the next step is 'ship it' — verifies, cleans up, and routes to merge/PR/park/discard — even when the user just says 'I'm done, what now?'."
+description: "Use when the feature is implementation-complete and the next step is 'ship it' — verifies, cleans up, routes to merge/PR/park/discard; never destroys work without explicit confirmation."
 domain: process
 workspaces:
   - engineering

package/dist/agent-src/skills/rule-writing/SKILL.md

@@ -236,6 +236,51 @@ rule for another reason. A batch edit across the rule set trips the
 kernel-prefix byte-stability gate, and that gate is right to fire — the kernel
 prefix is pinned deliberately.
 
+## Optional: enumerate condition-action clauses
+
+A rule body mixes two shapes. **Standing obligations** hold for every turn the
+rule is loaded ("every reply mirrors the user's language"). **Condition-action
+clauses** fire on a situation ("when the diff deletes a directory, surface it").
+The router matches on frontmatter; in-body conditionals are prose, so a rule's
+situational half is invisible to everything except a full read.
+
+Where a rule carries more than two of them, group them under a
+`## Conditions` heading, one bullet per clause, each in the shape
+**`<condition>` → `<action>`**. Two effects, both cheap:
+
+- A reader can answer "does this rule apply to what I am doing?" from a list
+  instead of by reading the body.
+- A condition that turns out to be unreachable becomes visible as a line, which
+  is the input `decision-review` needs to ask whether the clause still earns its
+  place.
+
+Optional on purpose. A rule with one conditional does not need a section to hold
+it, and a heading over a single bullet is ceremony.
+
+## Optional: state the decision-impact class
+
+`type:` is a **delivery** class — how the rule reaches the model. It says
+nothing about what is at stake when the rule fires, and kernel-membership and
+always-loaded-budget arguments were being made with no stated impact class at
+all. `decision_impact:` carries that, with three values:
+
+| Value | Meaning | Consequence |
+|---|---|---|
+| `overrides-model-default` | the model's base behaviour is wrong here | load-bearing; the strongest case for staying loaded |
+| `encodes-house-choice` | the model would make *a* defensible choice, not *ours* | stays until the house choice changes |
+| `already-complied-with` | the model does this unprompted | **the one value that permits removal** |
+
+The third carries an evidence bar, enforced by `lint_decision_impact`: it
+requires `decision_impact_evidence`, a pointer a reviewer can follow to the
+observation. The bar exists because that classification is what permits deleting
+a rule, and "the model probably does this anyway" is the cheapest possible way
+to remove a floor that was working precisely *because* nothing had crossed it —
+`active-remediation` names that failure as deleting a rule that is merely quiet.
+
+**Optional, and backfill is opportunistic.** Classifying all 111 rules in one
+batch is exactly the shape that trips `check_kernel_prefix_stability`. Add it to
+new rules, and to a rule you are already touching for another reason.
+
 ## Output format
 
 1. Complete rule file at `src/rules/{name}.md`