@event4u/agent-config 9.25.0 → 9.27.0

package/dist/agent-src/rules/framework-neutrality-in-generic-skills.md

@@ -43,6 +43,8 @@ collision_ok:
   "formrequest": "FormRequest named in a generic artifact is leakage — the lint surface"
   "phpstan": "phpstan named in a generic artifact is leakage — the lint surface"
   "rector": "rector named in a generic artifact is leakage — the lint surface"
+# obligation: line 65
+obligation_frequency: "per-edit"
 ---
 
 # framework-neutrality-in-generic-skills

package/dist/agent-src/rules/git-history-discipline.md

@@ -23,6 +23,8 @@ workspaces: [engineering]
 packs: [engineering-base]
 enforced_by:
   - "hook:block-no-verify"
+# obligation: line 35
+obligation_frequency: "per-commit"
 ---
 
 # Git History Discipline
@@ -82,4 +84,4 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 - [`commit-policy`](commit-policy.md) — commits are the user's call; rewriting them is a stronger version of the same restriction.
 - [`token-efficiency`](token-efficiency.md) — Iron Law on burning the user's tokens for cosmetic gain.
 - [`skill:git-workflow`](../skills/git-workflow/SKILL.md) — Safe Squash-After-Push protocol and Divergent-State Recovery decision tree.
-- `git … --no-verify` / `core.hooksPath` overrides — deterministically blocked by the `block-no-verify` PreToolUse guard (`src/scripts/hooks/block_no_verify.ts`, registered in `hook_manifest.yaml`).
+- `git … --no-verify` / `core.hooksPath` overrides — deterministically blocked by the `block-no-verify` PreToolUse guard (`src/scripts/hooks/block_no_verify.ts`, registered in `hook_manifest.yaml`) **on the three hosts that have a `pre_tool_use` slot at all** — augment, claude, cowork. On cursor, cline, windsurf, gemini and copilot the guard has nowhere to bind, so on those hosts the Iron Laws above are model-carried and "deterministically blocked" is not a claim this rule can make. Surfaced by the frequency join in `check_enforcement_coverage.ts`, which reports the per-commit obligation as uncovered on exactly those platforms.

package/dist/agent-src/rules/guidelines.md

@@ -9,6 +9,8 @@ triggers:
   - keyword: "convention"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+# obligation: line 16
+obligation_frequency: "per-edit"
 ---
 
 # Guidelines

package/dist/agent-src/rules/history-discipline.md

@@ -19,6 +19,8 @@ workspaces: [engineering]
 packs: [history-discipline]
 trust:
   level: professional
+# obligation: line 35
+obligation_frequency: "per-edit"
 ---
 
 # History Discipline

package/dist/agent-src/rules/icon-consistency.md

@@ -16,6 +16,8 @@ applies_to_user_types:
 self_contained: true
 workspaces: [engineering]
 packs: [frontend-design]
+# obligation: line 41
+obligation_frequency: "per-edit"
 ---
 
 # Icon Consistency

package/dist/agent-src/rules/image-likeness-and-rights.md

@@ -22,6 +22,8 @@ collision_ok:
   "/image:": "rights/likeness gate on the image-generation surface"
   "likeness": "its own core subject — the rights gate"
   "scripts/ai-image/adapters/": "adapter edits touch the likeness-gated generation path"
+# obligation: line 32
+obligation_frequency: "per-event"
 ---
 
 # Image Likeness and Rights

package/dist/agent-src/rules/improve-before-implement.md

@@ -20,6 +20,8 @@ collision_ok:
   "migration": "a migration is a significant behavioural change — the pre-implementation checks apply"
   "refactor": "refactor = significant change; the demand gate + three checks apply"
   "implement": "its own core trigger — pre-implementation validation"
+# obligation: line 45
+obligation_frequency: "per-task"
 ---
 
 # Improve Before Implement

package/dist/agent-src/rules/invite-challenge.md

@@ -12,6 +12,8 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+# obligation: line 62
+obligation_frequency: "per-task"
 ---
 
 # invite-challenge

package/dist/agent-src/rules/laravel-routing.md

@@ -20,6 +20,8 @@ collision_ok:
   "artisan": "artisan is a Laravel-flavoured PHP routing cue — load the laravel skill"
   "eloquent": "eloquent is a Laravel routing cue"
   "formrequest": "FormRequest is a Laravel routing cue"
+# obligation: line 29
+obligation_frequency: "none"
 ---
 
 # Laravel Routing

package/dist/agent-src/rules/laravel-translations.md

@@ -16,6 +16,8 @@ trust:
 install:
   default: false
   removable: true
+# obligation: line 23
+obligation_frequency: "per-edit"
 ---
 
 # Laravel Translations

package/dist/agent-src/rules/legal-safety-floor.md

@@ -31,6 +31,8 @@ trust:
 collision_ok:
   "controller": "'controller' is a GDPR role term (controller/processor) in the legal pack"
   "review this contract": "the legal-pack contract-review gate — both floors must fire"
+# obligation: line 103
+obligation_frequency: "per-task"
 ---
 <!-- agent-config:human-review-banner -->
 > HUMAN REVIEW REQUIRED · trust: advisory · owner: unknown

package/dist/agent-src/rules/lethal-trifecta-guard.md

@@ -20,6 +20,8 @@ enforced_by:
 collision_ok:
   "src/skills/": "skill authoring reviews tool grants and the egress leg"
   "src/agent-src/commands/": "command authoring reviews the three trifecta legs"
+# obligation: line 60
+obligation_frequency: "per-edit"
 ---
 
 # Lethal-Trifecta Guard

package/dist/agent-src/rules/linked-projects-onboarding-gate.md

@@ -23,6 +23,8 @@ trust:
   confidence: medium
 install:
   removable: true
+# obligation: line 30
+obligation_frequency: "per-session"
 ---
 
 # Linked-Projects Onboarding Gate

package/dist/agent-src/rules/low-impact-corpus-privacy-floor.md

@@ -10,6 +10,8 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer]
 packs: [meta]
+# obligation: line 28
+obligation_frequency: "per-edit"
 ---
 
 # Low-Impact Corpus — Privacy Floor

package/dist/agent-src/rules/markdown-safe-codeblocks.md

@@ -9,6 +9,8 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
+# obligation: line 23
+obligation_frequency: "per-turn"
 ---
 
 # Markdown Safe Codeblocks

package/dist/agent-src/rules/media-governance-routing.md

@@ -36,6 +36,8 @@ collision_ok:
   "/audio:": "routes the media policy layer for audio surfaces"
   "/video:": "routes the media policy layer for video surfaces"
   "likeness": "likeness prompts must load the policy layer before generation"
+# obligation: line 46
+obligation_frequency: "per-event"
 ---
 
 # Media Governance Routing

package/dist/agent-src/rules/media-sync-ground-truth.md

@@ -17,6 +17,8 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer, engineering, gtm]
 packs: [ai-video]
+# obligation: line 31
+obligation_frequency: "per-event"
 ---
 
 # Media Sync — Ground Truth Is the Audio

package/dist/agent-src/rules/minimal-safe-diff.md

@@ -17,6 +17,8 @@ enforced_by:
   - "hook:minimal-safe-diff"
 collision_ok:
   "fix": "a fix is the smallest change that solves the stated problem"
+# obligation: line 25
+obligation_frequency: "per-edit"
 ---
 
 # Minimal Safe Diff

package/dist/agent-src/rules/missing-tool-handling.md

@@ -9,6 +9,8 @@ routes_to:
   - "guideline:agent-infra/missing-tool-handling"
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
+# obligation: line 16
+obligation_frequency: "per-event"
 ---
 
 # Missing Tool Handling

package/dist/agent-src/rules/model-recommendation.md

@@ -13,6 +13,8 @@ routes_to:
   - "guideline:agent-infra/model-recommendation"
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
+# obligation: line 4
+obligation_frequency: "per-task"
 ---
 
 # Model Recommendation

package/dist/agent-src/rules/no-attribution-footers.md

@@ -8,6 +8,8 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
+# obligation: line 18
+obligation_frequency: "per-commit"
 ---
 
 # No Attribution Footers

package/dist/agent-src/rules/no-decorative-emojis-in-git-surfaces.md

@@ -17,6 +17,8 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+# obligation: line 27
+obligation_frequency: "per-commit"
 ---
 
 # No Decorative Emojis in Git Surfaces

package/dist/agent-src/rules/no-pr-progress-comments.md

@@ -10,6 +10,8 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+# obligation: line 20
+obligation_frequency: "per-commit"
 ---
 
 # No Unsolicited PR Progress Comments

package/dist/agent-src/rules/no-roadmap-references.md

@@ -22,6 +22,8 @@ enforced_by:
   - "validator:src/scripts/check_council_references.ts"
 collision_ok:
   "agents/roadmaps/": "roadmap edits are where transient-ref links get written"
+# obligation: line 47
+obligation_frequency: "per-edit"
 ---
 
 # No Transient References from Stable Artifacts

package/dist/agent-src/rules/notes-first-reasoning.md

@@ -17,6 +17,8 @@ workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
 collision_ok:
   "debug": "debug hypotheses belong in the session notes file"
+# obligation: line 35
+obligation_frequency: "per-turn"
 ---
 
 # Notes-First Reasoning

package/dist/agent-src/rules/onboarding-gate.md

@@ -11,6 +11,8 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 enforced_by:
   - "hook:onboarding-gate"
+# obligation: line 18
+obligation_frequency: "per-session"
 ---
 
 # Onboarding Gate

package/dist/agent-src/rules/output-discipline.md

@@ -12,6 +12,8 @@ workspaces: [engineering]
 packs: [engineering-base]
 enforced_by:
   - "validator:src/scripts/lint_output_slop.ts"
+# obligation: line 22
+obligation_frequency: "per-edit"
 ---
 
 # Output Discipline

package/dist/agent-src/rules/package-ci-checks.md

@@ -10,6 +10,8 @@ routes_to:
   - "skill:lint-skills"
 workspaces: [agent-config-maintainer]
 packs: [meta]
+# obligation: line 17
+obligation_frequency: "per-commit"
 ---
 
 # Package Ci Checks

package/dist/agent-src/rules/persona-governance.md

@@ -27,6 +27,8 @@ workspaces: [agent-config-maintainer]
 packs: [meta]
 enforced_by:
   - "validator:src/scripts/lint_persona_governance.ts"
+# obligation: line 41
+obligation_frequency: "per-edit"
 ---
 
 # Persona Governance

package/dist/agent-src/rules/php-coding.md

@@ -18,6 +18,8 @@ install:
   removable: true
 collision_ok:
   "phpstan": "phpstan findings are the PHP pattern floor's own quality surface"
+# obligation: line 25
+obligation_frequency: "per-edit"
 ---
 
 # Php Coding

package/dist/agent-src/rules/prefer-enums-over-literals.md

@@ -15,6 +15,8 @@ packs: [engineering-base]
 collision_ok:
   "migration": "migrations add columns — multi-state fields should land as enums from the start"
   "category": "a category field is the canonical enum candidate"
+# obligation: line 27
+obligation_frequency: "per-edit"
 ---
 
 # Prefer Enums Over Literal Values

package/dist/agent-src/rules/preservation-guard.md

@@ -15,6 +15,8 @@ packs: [meta]
 enforced_by:
   - "validator:src/scripts/check_condensation.ts"
   - "validator:src/scripts/skill_linter.ts"
+# obligation: line 22
+obligation_frequency: "per-edit"
 ---
 
 # Preservation Guard

package/dist/agent-src/rules/provider-lifecycle-discipline.md

@@ -30,6 +30,8 @@ collision_ok:
   "/audio:": "provider-tier gate for audio providers"
   "/video:": "provider-tier gate for video providers"
   "scripts/ai-image/adapters/": "adapter edits are the lifecycle contract's surface"
+# obligation: line 41
+obligation_frequency: "per-event"
 ---
 
 # Provider Lifecycle Discipline

package/dist/agent-src/rules/question-not-instruction.md

@@ -24,6 +24,8 @@ applies_to_user_types:
 self_contained: true
 workspaces: [engineering]
 packs: [meta]
+# obligation: line 32
+obligation_frequency: "per-turn"
 ---
 
 # Question Is Not an Instruction

package/dist/agent-src/rules/reviewer-awareness.md

@@ -13,6 +13,8 @@ routes_to:
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
 roles: [reviewer]
+# obligation: line 20
+obligation_frequency: "per-commit"
 ---
 
 # Reviewer Awareness

package/dist/agent-src/rules/roadmap-ci-steps-policy.md

@@ -30,6 +30,8 @@ packs: [meta]
 roles: [planner]
 collision_ok:
   "agents/roadmaps/": "roadmap steps must not schedule CI-shaped gates"
+# obligation: line 41
+obligation_frequency: "per-edit"
 ---
 
 # Roadmap CI-Steps Policy

package/dist/agent-src/rules/roadmap-progress-sync.md

@@ -16,6 +16,8 @@ enforced_by:
   - "hook:roadmap-progress"
 collision_ok:
   "agents/roadmaps/": "any roadmap touch regenerates the dashboard, same response"
+# obligation: line 26
+obligation_frequency: "per-edit"
 ---
 
 # Roadmap Progress Sync

package/dist/agent-src/rules/role-mode-adherence.md

@@ -9,6 +9,8 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
+# obligation: line 23
+obligation_frequency: "per-turn"
 ---
 
 # Role Mode Adherence

package/dist/agent-src/rules/rule-type-governance.md

@@ -10,6 +10,8 @@ workspaces: [agent-config-maintainer]
 packs: [meta]
 collision_ok:
   "src/rules/": "the always-vs-auto choice fires on every rule edit"
+# obligation: line 17
+obligation_frequency: "per-edit"
 ---
 
 # Rule Type Governance

package/dist/agent-src/rules/runtime-safety.md

@@ -10,6 +10,8 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+# obligation: line 32
+obligation_frequency: "per-edit"
 ---
 
 # Runtime Safety

package/dist/agent-src/rules/scale-discipline.md

@@ -26,6 +26,8 @@ trust:
 collision_ok:
   "migration": "R-A6 migration-safety owns reversibility/index/retention rules"
   "schema": "schema change routes the persistence pack floor (R-A6/R-A2)"
+# obligation: line 41
+obligation_frequency: "per-edit"
 ---
 
 # Scale Discipline

package/dist/agent-src/rules/secret-vcs-guard.md

@@ -27,6 +27,8 @@ enforced_by:
   - "validator:src/scripts/check_secret_leak.ts"
 collision_ok:
   "commit": "committing is the credential-leak moment this guard exists for"
+# obligation: line 43
+obligation_frequency: "per-edit"
 ---
 
 # Secret-in-VCS Guard

package/dist/agent-src/rules/security-sensitive-stop.md

@@ -26,6 +26,8 @@ enforced_by:
   - "none"
 collision_ok:
   "tenant": "tenancy is a threat-model-before-edit surface"
+# obligation: line 36
+obligation_frequency: "per-edit"
 ---
 
 # Security-Sensitive Stop Rule

package/dist/agent-src/rules/senior-engineering-discipline.md

@@ -25,6 +25,8 @@ collision_ok:
   "implement": "implementation = the invisible-controls checklist"
   "endpoint": "endpoint row of the surface-to-controls table"
   "component": "component work = generalize + reuse duty"
+# obligation: line 69
+obligation_frequency: "per-edit"
 ---
 
 # Senior Engineering Discipline

package/dist/agent-src/rules/session-canary.md

@@ -12,6 +12,13 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 enforced_by:
   - "hook:session-canary"
+# obligation: line 31
+obligation_frequency: "per-task"
+# frequency-override: the per-turn phrases in the body describe the CARRIER
+# (a per-turn beat is the closest reachable cover for a per-task obligation),
+# not the obligation itself, which is still the first reply of each new task.
+collision_ok:
+  "canary_name": "this rule owns what the NAME does once set and which of the three layers already supplies it; settings-ask-protocol owns how it is asked for and where the answer goes"
 ---
 
 # Session Canary
@@ -67,25 +74,62 @@ name it and suggest a fresh session or `/agent-handoff`, per
 - The greeting never substitutes for substance — it prefixes the answer, it is
   not the answer.
 
-## Enforcement — per session, NOT per task
-
-> **Enforced by:** [`scripts/session_canary_hook.ts`](../../scripts/session_canary_hook.ts)
-> (`session_start`, all hook-capable hosts) — injects the `<session-canary>`
-> contract block into every new session, so a fresh conversation cannot start
-> without it. **Copilot fallback:** no hook surface — this rule is the only
-> carrier; re-read it when the trigger fires.
-
-**The gap, stated because it was measured.** The injection fires on
-`session_start`; the obligation is per *task*. Nothing re-injects at a task
-boundary, so from the second task on the contract is model-carried.
-
-Conformance audit, 30 sessions, 2026-08-06: opening canary dropped on ~13 of 15
-task starts, often present only in the closing summary, twice carrying a name
-the settings chain did not resolve; the honesty clause fired zero times. No
-per-task gate ships — the audit found no harm beyond the lost signal, and a
-mechanism for a signal whose absence nobody acted on has no failure mode to
-match. The consequence stands: this canary cannot currently be relied on as the
-degradation detector its own rationale describes.
+## Enforcement — per turn, which is the closest reachable cover for per task
+
+> **Enforced by:** [`scripts/session_canary_hook.ts`](../../scripts/session_canary_hook.ts),
+> bound in **two** slots. `session_start` injects the full `<session-canary>`
+> contract once, so a fresh conversation cannot start without it.
+> `user_prompt_submit` injects a one-line beat every turn, which is what
+> actually reaches a task boundary.
+
+**Why two slots, and why not one.** The obligation is per *task*. No host has a
+per-task slot — Cline maps `TaskStart`/`TaskResume` onto `session_start`, and
+Claude Code has no task event at all — so "move the carrier to the right slot"
+was never available. Per-turn is a strict superset of per-task and is reachable,
+which is the whole argument: over-firing a greeting is a visible, cheap failure;
+under-firing is the silent one. The full contract stays at session scope because
+re-injecting ~800 characters every turn would buy the same coverage at roughly
+40× the tokens over a long session.
+
+**What that fixed, stated because it was measured.** Conformance audit, 30
+sessions, 2026-08-06, under session-scope-only injection: opening canary dropped
+on ~13 of 15 task starts, often present only in the closing summary, twice
+carrying a name the settings chain did not resolve; the honesty clause fired
+zero times. The frequency join in `check_enforcement_coverage.ts` now reports the
+carrier as covering the obligation — which is a claim about firing, not about
+compliance.
+
+**What the second audit found: the carrier fires and compliance did not
+follow.** Conformance round 5, 2026-08-07, reading the five highest-turn
+sessions with the carrier bound per turn: opening canary dropped on **24 of 29**
+task starts, the honesty clause fired **0** times, and the wrong name was
+emitted **twice** — "Mathias", which resolves from no layer of the chain
+(`identity.name` is `Matze`, `git config user.name` is `matze4u`), i.e. inferred
+from the ambient environment rather than read from settings. 24/29 against the
+earlier 13/15 is not a fall, and the two windows are not identical, so they are
+stated side by side rather than as a trend — but nothing here supports the claim
+that the miss rate moved. A reminder in context is therefore not a mechanism for
+this obligation: at higher frequency it is the same request, more often.
+
+**What the next mechanism has to be.** Not another injection. It has to be able
+to **refuse** — a check at delivery (`stop` is block-capable on this host, so a
+refused turn-end continues in the same turn) that rejects a task-start reply
+carrying no greeting. Proposed, not shipped; until it is, this obligation is
+model-carried in practice, whatever the frequency join reports.
+
+**The wrong-name half needs nothing, and that is worth stating.** The beat
+already carries the resolved value — `build_canary_reminder` emits
+`Canary active for "<name>"`, and the hook no-ops when no layer resolves a name —
+and both wrong-name occurrences predate it: 2026-08-04, where the per-turn beat
+landed 2026-08-06. The inference path they measure is already closed, so a third
+audit should not re-open it.
+
+**Two declared gaps, neither papered over.** On **Augment** there is no
+`user_prompt_submit` slot; its `stop` fires *after* the reply, so injecting
+there could not shape the reply the reminder is for, and counting it would be
+exactly the over-credit the frequency audit exists to remove. Augment therefore
+reports as an open gap rather than as covered. **Copilot** has no hook surface at
+all — this rule is the only carrier there; re-read it when the trigger fires.
 
 ## See also