@event4u/agent-config 9.24.0 → 9.26.0

package/dist/agent-src/commands/roadmap.md

@@ -2,14 +2,14 @@
 model_tier: medium
 name: roadmap
 disable-model-invocation: true
-argument-hint: "[create|ai-council|process-step|process-phase|process-full] [args]"
+argument-hint: "[create|ai-council|process-step|process-phase|process-full|next] [args]"
 pack: product-basic
-intent: "Roadmap dispatcher — create, process-step, process-phase, process-full, ai-council"
-routes_to: [roadmap-create, roadmap-ai-council, roadmap-materialize, roadmap-process-step, roadmap-process-phase, roadmap-process-full]
+intent: "Roadmap dispatcher — create, process-step, process-phase, process-full, next, ai-council"
+routes_to: [roadmap-create, roadmap-ai-council, roadmap-materialize, roadmap-process-step, roadmap-process-phase, roadmap-process-full, roadmap-next]
 replaces: []
 tier: 1
 visibility: advanced
-description: Roadmap orchestrator — routes to create (authoring) and process-step / process-phase / process-full (autonomous execution).
+description: Roadmap orchestrator — routes to create (authoring), process-step / process-phase / process-full (autonomous execution), and next (pick a roadmap and ship it).
 cluster: roadmap
 type: orchestrator
 suggestion:
@@ -40,6 +40,7 @@ paused for confirmation before every step) was removed —
 | `/roadmap:process-step` | `commands/roadmap/process-step.md` | Autonomously process the next open step, then stop |
 | `/roadmap:process-phase` (**default execution scope**) | `commands/roadmap/process-phase.md` | Autonomously process every open step in the current phase |
 | `/roadmap:process-full` | `commands/roadmap/process-full.md` | Autonomously process every open step across every phase |
+| `/roadmap:next` | `commands/roadmap/next.md` | Screen for the next executable roadmap, then carry it to a reviewable PR (selection + `process-full` + delivery) |
 
 Sub-command names match the locked contract in
 [`docs/contracts/command-clusters.md`](../docs/contracts/command-clusters.md).
@@ -70,6 +71,7 @@ each only binds a scope delta.
    > 3. process-step — process the next open step, then stop
    > 4. process-phase — process the current phase (default)
    > 5. process-full — process every open step across every phase
+   > 6. next — pick the next executable roadmap and ship it to a PR
 
 ## Rules
 
@@ -84,3 +86,9 @@ each only binds a scope delta.
   *"finish this phase"*) default to
   [`/roadmap:process-phase`](roadmap/process-phase.md) unless the user
   named a different scope.
+- **Selection intents** (*"take the next sensible roadmap"*, *"nimm dir
+  die nächste Roadmap vor"*, *"pick a roadmap and ship it"*) — i.e. the
+  user has NOT named a roadmap and wants one chosen — route to
+  [`/roadmap:next`](roadmap/next.md), which is the only sub that
+  screens and selects. The three `process-*` subs never choose across
+  roadmaps.

package/dist/agent-src/contexts/execution/subagent-routing.md

@@ -48,7 +48,10 @@ THE SAME MINUS THE QUOTA WIN.
    tier <t>`); a 429/quota error trips `tripCooldown` for that tier and
    falls back per the relation — never a retry loop. Under
    `budget_routing: ask`, the FIRST budget-motivated downshift of a session
-   is confirmed once; `auto` proceeds silently. Every budget-routed
+   is confirmed once, in the shape
+   [`settings-ask-protocol`](../../rules/settings-ask-protocol.md) fixes and
+   without persisting the answer (`subagents.budget_routing` is class C);
+   `auto` proceeds silently. Every budget-routed
    dispatch emits one `orchestration_record` line (tier + provenance-tagged
    token delta) so realized savings are measured, not asserted.
 

package/dist/agent-src/rules/decision-revisit-gate.md

@@ -14,6 +14,8 @@ routes_to:
   - "skill:decision-review"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+collision_ok:
+  "honest null": "this rule asks whether a recorded null may be REVISITED; evaluator-independence asks how one was PRODUCED — different decision points on the same artefact"
 ---
 
 # Decision Revisit Gate

package/dist/agent-src/rules/delegation-policy.md

@@ -50,8 +50,9 @@ clears — all of:
   [`auto-dispatch-classification`](../contexts/execution/auto-dispatch-classification.md)
   (≥1 independent, well-specified slice above the size floor).
 
-`subagents.auto: ask` → ask once before dispatching (per
-[`user-interaction`](user-interaction.md)); `auto: on` → surface the chosen mode
+`subagents.auto: ask` → ask once before dispatching, in the shape
+[`settings-ask-protocol`](settings-ask-protocol.md) fixes (the answer is not
+persisted — `subagents.auto` is class C); `auto: on` → surface the chosen mode
 + per-subtask tiers in one line. Any gate failing, or `auto: off`, or no host
 primitive → run in-session (clean no-op).
 

package/dist/agent-src/rules/design-fidelity.md

@@ -23,7 +23,9 @@ triggers:
   - phrase: "bau das nach"
   - phrase: "1:1 um"
   - phrase: "1:1 nach"
+  - phrase: "claude.site/artifacts"
   - file_pattern: "*design.html"
+  - path_prefix: ".claude/design-system/"
 applies_to_user_types:
   - "creator"
   - "developer"
@@ -96,13 +98,27 @@ artifact is simply attached. The last is covered by `file_pattern: *design.html`
 HTML edit in every project and be strictly worse than the gap it closes. A
 handover under some other filename needs one word in the prompt.
 
+Two further handover shapes carry the artifact without any of the above:
+
+- **A capability URL.** A published artifact is handed over as a link, not a
+  file — so `phrase: "claude.site/artifacts"` fires on the *published-artifact
+  path*, not on the host. `claude.ai` alone is a chat link and must stay quiet:
+  a keyword on the bare domain would fire on "I pasted this from claude.ai",
+  which is a conversation reference, not a spec.
+- **A design-system directory.** `path_prefix: ".claude/design-system/"` — the
+  conventional location for a handed-over token/component set. The prefix is the
+  vendor-scoped directory, never a bare `design-system/`, which is a normal
+  source folder in a large fraction of frontend repos.
+
 The trigger set is deliberately phrase-heavy on the German side and on
 `artifact`: a bare `artifact` keyword fires on "the CI build artifact is 40 MB".
 `ROUTING_MATRIX` in
 [`design_fidelity_routing.test.ts`](../../tests/scripts/design_fidelity_routing.test.ts)
 pins both halves — every class that must route, and the near-misses that must
 stay silent (fixture `daf-port-trigger-de`). Extending the set without adding a
-near-miss row there is how an over-broad trigger lands.
+near-miss row there is how an over-broad trigger lands: each of the two triggers
+above ships with its own near-miss row (`near-claude-ai-chat-link`,
+`near-generic-design-system-dir`).
 
 Body migrated to [`guideline:design-fidelity-mechanics`](../docs/guidelines/design-fidelity-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — surgical visual edits (targeted-edit vs redesign-trigger discipline, stable anchors), asset & imagery discipline (owned-asset path, third-party delivery is self-hosted by default, real-imagery-as-proof, iconography floor, no unrequested filler), deviation-surfacing shape, failure-mode catalog, `daf-*` fixtures.
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/design-review-after-ui-write.md

@@ -0,0 +1,116 @@
+---
+type: "auto"
+tier: "2b"
+alwaysApply: false
+description: "UI written or changed — review it against the design contract before calling it done; the write-side twin of ui-audit-gate"
+triggers:
+  - path_prefix: "resources/views/"
+  - path_prefix: "resources/js/"
+  - keyword: "component"
+  - keyword: "design token"
+routes_to:
+  - "skill:design-review"
+  - "skill:accessibility-auditor"
+workspaces: [agent-config-maintainer, engineering]
+packs: [frontend-design]
+collision_ok:
+  "component": "a written component is reviewed before it is called done — the write-side half"
+  "design token": "same surface, opposite side: ui-audit-gate inventories tokens before the write, this reviews what the write emitted"
+  "resources/views/": "both halves of one UI loop fire on the same path — audit before, review after; neither substitutes for the other"
+  "resources/js/": "both halves of one UI loop fire on the same path — audit before, review after; neither substitutes for the other"
+---
+
+# Design Review After UI Write
+
+The UI loop was closed on one side only. [`ui-audit-gate`](ui-audit-gate.md)
+covers the **read** side — inventory what exists before adding a component — and
+routes to `existing-ui-audit`. Nothing covered the **write** side: **zero rules
+routed to `skill:design-review`**, so a component could be written, declared
+done, and never looked at against the contract it was supposed to satisfy.
+
+This is that rule's twin, deliberately built to the same shape: same tier, same
+pack, same diff-decidable allow-list, and the same honest scope.
+
+## The Iron Law
+
+```
+UI WRITTEN OR CHANGED IS NOT DONE UNTIL IT IS REVIEWED.
+NEVER CLAIM A UI CHANGE IS COMPLETE ON "IT LOOKS RIGHT" — THAT IS A VERDICT
+WITHOUT EVIDENCE. NO RENDER CAPABILITY → SCOPE THE VERDICT TO WHAT WAS
+STATICALLY CHECKED AND SAY SO. NEVER "LOOKS GOOD" WITH NOTHING BEHIND IT.
+```
+
+## What "reviewed" means
+
+The verdict is gated on evidence, not on having run a skill:
+
+- **Render capability present** (Playwright MCP, Chrome DevTools, or a live
+  preview URL) → the [design-artifact verification checklist](../docs/contracts/design-artifact-verification.md#verification-checklist)
+  steps 1–5. A UI task does not pass without render evidence.
+- **Render capability absent** → the verdict is **scoped to the static checks
+  that actually ran** and says which those were. This is not a downgrade to be
+  hidden; `design-review` itself states it ("scope the verdict to what was
+  statically checked and say so"). An unscoped "looks good" is the failure.
+- **A provided artifact is the spec** → findings the artifact *covers* are
+  informational, not defects, per [`design-fidelity`](design-fidelity.md). The
+  review does not "improve" the user's own design.
+
+## Allow-list — `ui-trivial`, decidable from the diff alone
+
+Skip only when **all** hold:
+
+- ≤ 1 file, ≤ 5 changed lines, no new component, no new state, no new dependency.
+- Inside the work engine, `directive_set == "ui-trivial"` — the dispatcher states
+  it directly. Outside it, the same conditions are read **off the diff**, which
+  is observable without any dispatcher state.
+
+The list is deliberately the engine's five conditions, not the four its
+sibling rule's prose carries: `ui_trivial/apply.ts` enforces `new_dependency`
+too, and a twin that copied the shorter prose would inherit a gap the engine
+does not have.
+
+## Honest scope — what this rule does NOT enforce
+
+```
+THE REVIEW OBLIGATION IS MODEL-CARRIED. NEVER CLAIM THE REVIEW RAN
+AS IF IT WERE VERIFIED.
+```
+
+There is no artefact a chat session can point at to prove a design review
+happened — "I ran `design-review`" is self-report, and self-report is not
+enforcement. So this rule ships `enforced_by: none`, the same honesty boundary
+`ui-audit-gate`, `security-sensitive-stop`, and `untrusted-input-defense` state
+for their own obligations, rather than pretending a satisfiable-by-assertion
+condition is a gate.
+
+What that leaves, and it is the useful part: the write side now has a named
+obligation and a route to the skill that discharges it, where before it had
+neither. Full enforcement needs the work-engine `review`/`polish` gates (which
+already act on `a11y_violation` and `token_violation` findings) or pack-scoped
+rule projection — a maintainer decision, never an automated one.
+
+One asymmetry worth stating: `design-review` lives in `engineering-base` while
+this rule is scoped to `frontend-design`. The route still resolves — a rule may
+name a skill from another pack — but a consumer with `frontend-design` and
+without `engineering-base` gets the obligation without the skill. That is why
+`accessibility-auditor` is a second route: it is the part of the review that
+must not depend on the pairing.
+
+## Failure modes
+
+- Writing the component and calling it done because the tests pass — tests do not
+  look at it.
+- "Looks good" as a verdict with no render, no static check named, and no scope.
+- Running the review and acting on findings the provided artifact covers, i.e.
+  redesigning the user's spec under the banner of quality.
+- Treating the a11y half as optional because the visual half looked fine.
+- Skipping the review for "just one tile" — the same bypass `ui-audit-gate`
+  names on its own side.
+
+## See also
+
+- [`ui-audit-gate`](ui-audit-gate.md) — the read-side twin; audit before writing.
+- [`design-review`](../skills/design-review/SKILL.md) — the 7-phase review this routes to.
+- [`accessibility-auditor`](../skills/accessibility-auditor/SKILL.md) — the WCAG half.
+- [`design-fidelity`](design-fidelity.md) — a provided artifact is the spec; covered findings are informational.
+- [`verify-before-complete`](verify-before-complete.md) — the general no-claim-without-evidence gate this applies to UI.

package/dist/agent-src/rules/evaluator-independence.md

@@ -0,0 +1,111 @@
+---
+type: "auto"
+tier: "2a"
+alwaysApply: false
+description: "Commissioning a review/judge/blind-pass on your own work — never author the verdict, never narrow the scope, record the prompt with the result"
+triggers:
+  - keyword: "blind review"
+  - keyword: "blind pass"
+  - keyword: "honest null"
+  - keyword: "no-findings"
+  - keyword: "adversarial review"
+  - keyword: "judge"
+  - phrase: "review my own"
+  - phrase: "commission a review"
+  - phrase: "second opinion on my"
+self_contained: true
+workspaces: [engineering]
+packs: [engineering-base]
+enforced_by:
+  - "hook:evidence-independence"
+collision_ok:
+  "honest null": "this rule asks how a recorded null was PRODUCED; decision-revisit-gate asks whether it may be REVISITED — different decision points on the same artefact"
+---
+
+# Evaluator Independence
+
+When the agent commissions a review, judge, blind pass, or council run **on its
+own work**, it is both the author and the author of the evaluator's prompt. That
+second role is the one nobody was watching.
+
+## The Iron Law
+
+```
+NEVER AUTHOR THE VERDICT INTO AN EVALUATOR'S PROMPT.
+NEVER NARROW THE SCOPE OF A REVIEW YOU COMMISSIONED ON YOUR OWN WORK.
+A SELF-COMMISSIONED REVIEW IS ADMISSIBLE AS GATE EVIDENCE ONLY WHEN THE PROMPT
+IS RECORDED ALONGSIDE THE VERDICT.
+A SECOND EVALUATION OF THE SAME WORK IN ONE TURN IS VERDICT SHOPPING, NOT RIGOUR.
+```
+
+## The failure this exists to stop
+
+Measured, once, at maximum cost (conformance audit 2026-08-06):
+
+> The agent dispatched a "blind reviewer" over its own change. It wrote that
+> reviewer's prompt itself, put **"NO-FINDINGS is expected and welcome"** into it,
+> and narrowed the scope to four files it chose. The reviewer returned
+> NO-FINDINGS. That honest-null was committed as **binding gate evidence**. An
+> unsteered pass over the same delta later found 5 findings, one of them
+> critical, already live on the trunk.
+
+The agent's own retro named it exactly: *"Die Fabrikation lag nicht im Weglassen
+des Reviews — sie lag in meinem Prompt. Ich habe die Antwort vorgeladen und dann
+als Evidenz verbucht."* The review ran. The process was followed. The evidence
+was manufactured anyway.
+
+## What this requires
+
+1. **Neutral prompt.** No expectation of the outcome, in either direction. Not
+   "confirm there are no issues", not "I believe this is clean", not "just
+   confirm". Ask for findings; do not describe the finding count you expect.
+2. **Scope you did not choose to flatter yourself.** The scope is the whole
+   delta, or a boundary a human set. "These four files" chosen by the author of
+   those files is not a scope, it is a filter.
+3. **The prompt ships with the verdict.** A recorded honest-null whose prompt is
+   not recoverable is not evidence — nobody can check what was asked.
+4. **One evaluation per turn per subject.** Re-running with a different prompt or
+   scope after an unwelcome verdict selects the answer instead of measuring it.
+
+## When it does NOT fire
+
+- **Ordinary parallel fan-out.** Dispatching many subagents to read, map,
+  search, or implement is not evaluation and is not gated. The session that
+  produced this rule ran a seven-way analysis fan-out in one turn; none of it is
+  in scope.
+- A review **a human** commissioned or whose prompt a human wrote.
+- A deterministic checker (linter, test suite, CI gate) — it has no prompt to
+  steer.
+
+## Enforcement — honest scope
+
+[`evidence_independence.ts`](../scripts/hooks/evidence_independence.ts) is a
+`pre_tool_use` concern. It **blocks** a dispatch whose prompt carries a
+pre-loaded verdict, and **blocks** a second *self-scoped* evaluation dispatch in
+the same turn; it **warns** on the first. It reads the prompt the agent is about
+to send, so items 1 and 4 above are mechanically enforced.
+
+Two limits, stated because round 2 measured them. The pre-loaded-verdict list is
+a **phrase list**, so a paraphrase evades it — it catches recurrences of known
+steering wording, not steering as such. And the turn boundary is the
+authorization ledger's `detected_at` stamp, because the envelope carries no turn
+id; with no ledger yet, the counter falls back to session scope.
+
+Items 2 and 3 — an honestly chosen scope, and recording the prompt with the
+verdict — are **not** enforced by anything. A narrowed scope is not decidable
+from the prompt alone, and no validator reads the artefacts a verdict lands in.
+They are stated here as obligations and are model-carried. Saying so is the
+point: this rule exists because a process that *looked* followed produced
+fabricated evidence, and claiming coverage it does not have would repeat that.
+
+## See also
+
+- [`verify-before-complete`](verify-before-complete.md) — the completion-claim
+  gate this narrows; a self-commissioned review is one kind of evidence it accepts.
+- [`adversarial-review`](../skills/adversarial-review/SKILL.md) — how to ask for a
+  real critique.
+- [`delegation-policy`](delegation-policy.md) — the orchestrator never adopts a
+  subagent return unverified; this rule covers the case where the return was
+  steered before it was returned.
+- [`direct-answers`](direct-answers.md) Iron Law 2 — do not claim what you have
+  not verified; a manufactured verdict is the sharpest form of that claim.

package/dist/agent-src/rules/session-canary.md

@@ -12,6 +12,8 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 enforced_by:
   - "hook:session-canary"
+collision_ok:
+  "canary_name": "this rule owns what the NAME does once set and which of the three layers already supplies it; settings-ask-protocol owns how it is asked for and where the answer goes"
 ---
 
 # Session Canary
@@ -67,7 +69,7 @@ name it and suggest a fresh session or `/agent-handoff`, per
 - The greeting never substitutes for substance — it prefixes the answer, it is
   not the answer.
 
-## Enforcement
+## Enforcement — per session, NOT per task
 
 > **Enforced by:** [`scripts/session_canary_hook.ts`](../../scripts/session_canary_hook.ts)
 > (`session_start`, all hook-capable hosts) — injects the `<session-canary>`
@@ -75,6 +77,18 @@ name it and suggest a fresh session or `/agent-handoff`, per
 > without it. **Copilot fallback:** no hook surface — this rule is the only
 > carrier; re-read it when the trigger fires.
 
+**The gap, stated because it was measured.** The injection fires on
+`session_start`; the obligation is per *task*. Nothing re-injects at a task
+boundary, so from the second task on the contract is model-carried.
+
+Conformance audit, 30 sessions, 2026-08-06: opening canary dropped on ~13 of 15
+task starts, often present only in the closing summary, twice carrying a name
+the settings chain did not resolve; the honesty clause fired zero times. No
+per-task gate ships — the audit found no harm beyond the lost signal, and a
+mechanism for a signal whose absence nobody acted on has no failure mode to
+match. The consequence stands: this canary cannot currently be relied on as the
+degradation detector its own rationale describes.
+
 ## See also
 
 - [`direct-answers`](direct-answers.md) — canonical reply-close obligation.

package/dist/agent-src/rules/settings-ask-protocol.md

@@ -0,0 +1,176 @@
+---
+type: "auto"
+tier: "2a"
+alwaysApply: false
+description: "Asking the user about a setting — one question per command execution, a fixed four-slot shape, and the key's class decides where the answer goes"
+triggers:
+  - keyword: "settings:set"
+  - keyword: "canary_name"
+  - keyword: "rich_skills"
+  - keyword: "budget_routing"
+  - keyword: "adversarial_council"
+  - keyword: "learn_on_session_end"
+  - keyword: "open_edited_files"
+  - phrase: "ask about a setting"
+  - phrase: "settings question"
+  - phrase: "should I enable"
+  - phrase: "nickname"
+  - path_prefix: "docs/contracts/settings-classes.md"
+self_contained: true
+workspaces: [agent-config-maintainer, engineering]
+packs: [meta]
+routes_to:
+  - "contract:settings-classes"
+enforced_by:
+  - "none"
+collision_ok:
+  "canary_name": "the nickname ask is this protocol's canonical B-class instance — session-canary owns what the NAME then does and which layers already supply it, this rule owns how it is asked for and where the answer goes"
+---
+
+# Settings-Ask Protocol
+
+A settings question is the one ask where the agent poses the question *and* owns
+where the answer goes. Nine keys can produce one, in two mechanisms that look
+identical from outside and differ completely underneath.
+
+## The Iron Law
+
+```
+AT MOST ONE SETTINGS QUESTION PER COMMAND EXECUTION. NEVER TWO.
+THE KEY'S CLASS DECIDES WHERE THE ANSWER GOES — NEVER THE CONVENIENCE OF THE MOMENT.
+CLASS B → PERSIST VIA `settings:set --source jit-answer`. ASKED ONCE, EVER.
+CLASS C SET TO `ask` → THIS RUN ONLY. THE AGENT NEVER PERSISTS IT.
+FURTHER UNDECIDED KEYS TAKE THE CONSERVATIVE DEFAULT SILENTLY AND ARE NAMED
+IN THE END-SUMMARY WITH THE COMMAND THAT CHANGES THEM.
+A SILENT PERMISSIVE DEFAULT IS A DECISION TAKEN IN THE USER'S NAME. NEVER TAKE ONE.
+```
+
+## The four slots
+
+1. **What is needed** — the key in plain words, not the dotted path alone.
+2. **Why now** — the concrete thing in *this* run that cannot proceed without it.
+3. **Options, default marked** — the conservative option is always present and
+   always marked as what happens if the user says nothing.
+4. **Where the answer is stored** — one line, and it is not optional: it is the
+   only way to tell a one-run answer from a standing consent.
+
+Slot 4 is read from the class, never from taste:
+
+| Class | Slot 4 reads | Writer |
+|---|---|---|
+| **B** (3 keys) | "persisted to your global settings — you will not be asked again" | `agent-config settings:set <key> <value> --source jit-answer` |
+| **C** set to `ask` | "not saved; making it permanent is a human edit or the GUI" | none — the agent writes nothing |
+
+**"Not saved" is about persistence, not about how long the answer is honoured.**
+How long it stays cached in working state is the key's own business, and several
+keys state their own scope. Reading the C path as "re-ask every execution" would
+turn a fence against illegal writes into a source of extra questions.
+
+## The nine keys
+
+**Class B — persist once**: `personal.canary_name` ·
+`personal.open_edited_files` · `memory.learn_on_session_end`. Each ships a
+conservative default (`""`, `false`, `false`), so absent is indistinguishable
+from *no* and never from *yes*.
+
+**Class C carrying an `ask` value in its own enum** — a runtime question whose
+answer dies with the run: `subagents.budget_routing` and `worktrees.mode` (both
+**ship** as `ask`), plus `tokens.rich_skills`, `subagents.auto`,
+`subagents.adversarial_council`, `decision_engine.on_block` (which can be set to
+`ask` by a human but do not ship that way).
+
+## The budget
+
+The first key that genuinely blocks the run gets the question. Every other
+undecided key resolves to its conservative default **without a question** and
+appears in the end-summary as one line: key, value taken, command that changes it.
+
+**The split is computed, not chosen.** `planSettingsAsks` in
+`src/shared/settingsAsks.ts` returns the single key asked, the keys taking their
+default silently, and the keys skipped with a reason; `silentDefaultsSummary`
+renders lines that ride **inside** the one end-summary
+([`direct-answers`](direct-answers.md) Iron Law 3).
+
+Two questions in one execution is the violation this rule prevents.
+Batching them into a single numbered-options block is the same violation wearing
+a different shape: one *block* is one question only when a single number answers
+it ([`user-interaction`](user-interaction.md) § question pacing).
+
+## Non-interactive executions ask nothing, ever
+
+CI, a pipe, a hook, MCP serving, `AGENT_CONFIG_NO_UI`, a headless display: the
+budget is **zero**, not one. `nonInteractiveReason` in
+`src/shared/interactiveContext.ts` is the predicate; `interactive: false` makes
+`planSettingsAsks` carry no ask by construction. Defaults taken are still named —
+silent is not invisible. A question nobody can answer is not a question; it is a
+hang, or a default taken in the user's name wearing a prompt's clothes.
+
+## Who picks the moment — the half no gate can check
+
+The class contract's B invariant has two halves. Half one (a conservative
+default) is linted. Half two binds here: the trigger must be the **user's own
+request arriving at a point where the setting is genuinely required**. A
+threshold the agent watched, a moment it judged favourable, or a convenient lull
+are not triggers. If the run would complete without the setting, there is no
+question.
+
+## Worked example — the nickname, the canonical B ask
+
+`personal.canary_name` is un-inferrable and arms the session-degradation canary,
+so it is the one settings question a fresh session legitimately asks. Prefill so
+accepting costs one keypress:
+
+```bash
+git config user.name        # first choice — the name they already chose here
+# then: $USER, then $USERNAME (Windows). Never $USER alone.
+```
+
+On an answer: `agent-config settings:set personal.canary_name "<name>" --source jit-answer`.
+
+**Do not ask an already-armed user.** The browser wizard writes `identity.name`
+into `settings/.agent-user.yml`, the canary's third resolution layer, so a wizard
+user is already covered ([`session-canary`](session-canary.md) resolves all
+three). Check before asking.
+
+## Before a consent-gated action — verify the record, not the value
+
+`true` a human chose and `true` the machine inferred are the same byte and not
+the same permission. `consentVerdict` in `src/shared/settingsConsent.ts` grants on
+`jit-answer` / `gui` / `manual` and on a hand-edited file (which the class
+contract guarantees carries no stamp); it withholds on the conservative default,
+on a permissive value nothing records, and on `auto-detected` — an agent that may
+write its own provenance must not reach its own permission by observing the
+world. This is also the reader the provenance sidecar was missing: it was written
+by `settings:set` and only *displayed* by the GUI.
+
+## When NOT to fire
+
+- Class A — resolves to its default, never asked.
+- Class C **not** set to `ask` — no question; a change is a human edit.
+- Already decided on any resolution layer, or the run completes without it.
+- **The `ask` routes to a permission gate.** `worktrees.mode: ask` means
+  `scope-control`'s per-creation gate applies — a permission ask about an
+  *action*, which that rule owns; a storage line there would store nothing.
+- **The `ask` is code, not agent-carried.** `decision_engine.on_block: ask` is a
+  TTY prompt in `work_engine/hooks/builtin/decision_gate.ts`.
+
+## Honest enforcement — `enforced_by: none`
+
+No gate counts the questions in a chat turn, and no B key currently gates an
+action through a guard: the two that gate behaviour
+(`personal.open_edited_files`, `memory.learn_on_session_end`) are read as values,
+and the action they govern is prose. So the budget, the four slots, the
+who-picks-the-moment half, and the obligation to consult `consentVerdict` are all
+model-carried. On a prose-only host ask-once can degrade to ask-never. The
+deterministic fences sit one layer down and guard a different thing:
+`settings:set` and the GUI write route both refuse every C key and fail closed on
+an unreadable contract, so a protocol violation cannot become an illegal *write* —
+only a badly-shaped *ask*.
+
+## See also
+
+- [`docs/contracts/settings-classes.md`](../docs/contracts/settings-classes.md) — the A/B/C source of truth; slot 4 is read from it.
+- [`ask-when-uncertain`](ask-when-uncertain.md) — one question per turn; this narrows it to one *settings* question per execution.
+- [`no-cheap-questions`](no-cheap-questions.md) — the floor a settings question clears before it is asked at all.
+- [`user-interaction`](user-interaction.md) — the numbered-options shape slot 3 uses.
+- [`session-canary`](session-canary.md) — what the nickname answer activates, and the layers to check first.

package/dist/agent-src/rules/token-budget-discipline.md

@@ -31,9 +31,12 @@ TO THE FULL FRUGALITY CANON (telegraph-speak, thin-projector).
 | `rich` | Must be declared + justified | **Exempt** | **Never trimmed** | 2000–3500 tokens |
 
 Read `tokens.rich_skills` from `.agent-settings.yml` (default `on`) to determine
-whether rich skills may load in full. If `off`, treat them as
-`standard`. If `ask`, surface the estimated token delta (≈ skill file size in
-chars / 4) and wait for user confirmation; cache the answer for the session.
+whether rich skills may load in full. If `off`, treat them as `standard`. If
+`ask`, the question's shape is
+[`settings-ask-protocol`](settings-ask-protocol.md)'s, not this rule's; what only
+this rule knows is the number to put in it — the estimated token delta, ≈ skill
+file size in chars / 4. The answer is cached for the session and never persisted
+(`tokens.rich_skills` is class C).
 
 ## Requirements for `token_budget_class: rich`
 

package/dist/agent-src/rules/ui-audit-gate.md

@@ -16,6 +16,9 @@ workspaces: [agent-config-maintainer, engineering]
 packs: [frontend-design]
 collision_ok:
   "component": "no new component without audit findings — its core subject"
+  "design token": "same surface, opposite side: this inventories tokens before the write, design-review-after-ui-write reviews what the write emitted"
+  "resources/views/": "both halves of one UI loop fire on the same path — audit before, review after; neither substitutes for the other"
+  "resources/js/": "both halves of one UI loop fire on the same path — audit before, review after; neither substitutes for the other"
 ---
 
 # UI Audit Gate

package/dist/agent-src/rules/user-interaction.md

@@ -52,6 +52,29 @@ the script is the deterministic safety net.
 
 If in doubt, split into serial turns — never a long batched prompt.
 
+## The trigger is a decision, not a format
+
+```
+THE OBLIGATION FIRES ON HANDING A DECISION TO THE USER — IN ANY FORM.
+NOT ON THE PRESENCE OF A NUMBERED LIST.
+A TRAILING FREE-TEXT OFFER IS AN ASK. A BARE YES/NO IS AN ASK.
+```
+
+Measured (30-session conformance audit, 2026-08-06): **every** malformed ask was
+a one-line parenthetical or a trailing free-text offer — *"sag Bescheid, wenn
+ich die drei Zeilen mitnehmen soll"*, *"Soll ich das so umsetzen?"* — while the
+same sessions formatted their **large** asks perfectly. So the rule is being
+read as *if numbered options, then a recommendation line*. It is the other way
+round, and an ask that feels too small for a block is exactly the one that
+escapes the format. Three further caught shapes: a contentless filler option; an
+inline `(Empfohlen)` tag **beside** the recommendation line (the dual source
+Iron Law 1 forbids); an option set answerable only as `1,3,4`.
+
+**No gate ships for this.** `check_reply_consistency` can read a draft on stdin,
+but it inspects *numbered-option blocks* — and every measured failure had no
+block by construction, so it scans exactly the surface that did not fail. `conformance:behavior` deliberately does not score ask-shape,
+so an unmoved rate is a finding rather than a silence.
+
 ## Mechanics — rationale, failure modes, format details, examples
 
 The "why take a position", position-agnostic clause, format

package/dist/agent-src/skills/finishing-a-development-branch/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: medium
 name: finishing-a-development-branch
-description: "Use when the feature is implementation-complete and the next step is 'ship it' — verifies, cleans up, and routes to merge/PR/park/discard — even when the user just says 'I'm done, what now?'."
+description: "Use when the feature is implementation-complete and the next step is 'ship it' — verifies, cleans up, routes to merge/PR/park/discard; never destroys work without explicit confirmation."
 domain: process
 workspaces:
   - engineering

package/dist/agent-src/skills/recursive-verification/SKILL.md

@@ -48,6 +48,19 @@ until a benchmark gate authorises it per host.
 > major unless external evidence appears first. This skill is NOT sold as a
 > quality-lift mechanism.
 
+> **Scope of that null — what it does NOT close.** It measured a loop that ADDS
+> a critic to judge whether an attempt was good enough (deterministic
+> scorer-as-critic, `max_depth=1`, weak host, `capH-debug`). It is not evidence
+> about retrying on a check that has **already returned red**: there the verdict
+> is deterministic and in hand, and no critic is introduced, so there is nothing
+> for the null to be null about. The measurement's own decisive finding inverts
+> in that case — recursion was redundant because the first attempt already
+> passed the critic 72% of the time, so cost scaled with every task while benefit
+> sat in the ~28% tail; a red-triggered retry costs nothing on the passing
+> majority and fires only on the tail. What the null DOES bind, for any such
+> loop, is the falsification shape: pre-register the reduction it must deliver,
+> and revert rather than narrate if it does not.
+
 ## The Iron Law
 
 ```