@event4u/agent-config 9.26.0 → 9.28.0

package/dist/agent-src/rules/runtime-safety.md

@@ -10,6 +10,8 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+# obligation: line 32
+obligation_frequency: "per-edit"
 ---
 
 # Runtime Safety

package/dist/agent-src/rules/scale-discipline.md

@@ -26,12 +26,16 @@ trust:
 collision_ok:
   "migration": "R-A6 migration-safety owns reversibility/index/retention rules"
   "schema": "schema change routes the persistence pack floor (R-A6/R-A2)"
+# obligation: line 41
+obligation_frequency: "per-edit"
 ---
 
 # Scale Discipline
 
 Pack floor for the `scale-discipline` pack (default-off; auto-activates
-when the pack is installed). AI agents produce functionally correct but
+when the pack is installed — `agent-config packs:active` says whether it is,
+and names the degraded case where zero packs load and this floor cannot
+activate at all). AI agents produce functionally correct but
 scale-hostile persistence code — this rule binds the failure classes to
 deterministic pattern lints where possible and to review advice where not.
 

package/dist/agent-src/rules/secret-vcs-guard.md

@@ -27,6 +27,8 @@ enforced_by:
   - "validator:src/scripts/check_secret_leak.ts"
 collision_ok:
   "commit": "committing is the credential-leak moment this guard exists for"
+# obligation: line 43
+obligation_frequency: "per-edit"
 ---
 
 # Secret-in-VCS Guard

package/dist/agent-src/rules/security-sensitive-stop.md

@@ -26,6 +26,8 @@ enforced_by:
   - "none"
 collision_ok:
   "tenant": "tenancy is a threat-model-before-edit surface"
+# obligation: line 36
+obligation_frequency: "per-edit"
 ---
 
 # Security-Sensitive Stop Rule

package/dist/agent-src/rules/self-repair-loop.md

@@ -0,0 +1,103 @@
+---
+type: "auto"
+tier: "2a"
+description: "An observed defect in the agent's own behaviour becomes a queued record and a fix against agent-config — never a silent shrug"
+triggers:
+  - keyword: "self-repair"
+  - keyword: "self-repair-queue"
+  - phrase: "nicht richtig gearbeitet"
+  - phrase: "du hast das falsch"
+  - phrase: "you ignored the rule"
+  - phrase: "that was wrong"
+self_contained: true
+workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
+packs: [meta]
+enforced_by:
+  - "hook:self-repair"
+# obligation: line 28
+obligation_frequency: "per-turn"
+---
+
+# Self-Repair Loop
+
+A defect in how the agent behaved is a defect in **agent-config**, not in the
+user's project. The user should not have to file it, and the next user should
+not meet it again. Two intake paths fill one queue: the user says so
+(`user_prompt_submit`), or a deterministic detector fires at turn end (`stop`).
+
+## The Iron Law
+
+```
+AN OBSERVED DEFECT IN THE AGENT'S OWN BEHAVIOUR IS QUEUED AND FIXED — NEVER SHRUGGED OFF.
+THE DEFECT BELONGS TO AGENT-CONFIG. NEVER "FIX" IT BY EDITING THE USER'S PROJECT.
+CORRECT THE TURN OPENLY IN FRONT OF THE USER. NEVER RE-RUN IT SILENTLY TO HIDE THE MISS.
+THE OUTWARD STEP — PUSH, PR, ISSUE — NEEDS THE USER'S WORD THIS TURN. NO EXCEPTION.
+```
+
+## When the queue line appears
+
+`<self-repair-queue>` is injected at prompt time while records are open. It is
+work, not a notification:
+
+1. **Read it** — `agent-config self-repair:status`, then the newest record
+   under `agents/runtime/self-repair/`.
+2. **Name the surface that failed** — the rule, skill, gate, or missing carrier
+   that allowed the behaviour. A defect with no named surface is an apology,
+   not a fix.
+3. **Author the fix against agent-config** — in a checkout if one exists, so
+   the release can be a pull request; otherwise the report alone becomes an
+   issue.
+4. **Offer the release** — `agent-config self-repair:release <fingerprint>`;
+   `--dry-run` shows route and body without touching the network. Running it is
+   the user's call, per
+   [`non-destructive-by-default`](non-destructive-by-default.md).
+
+## Correct openly, never silently
+
+Reported by the user → redo the task properly in the same turn, visibly, saying
+what changed. Found by a detector → say so at the next opportunity and correct
+it. Forbidden is the hidden version: re-running the turn so the miss never
+surfaces. That mechanism (`attempt → critic → re-attempt`) was benchmarked and
+falsified under ADR-106 — capability Δ = 0, council verdict TERMINAL — and the
+same verdict names the replacement lever: refine the rules on the failure tail,
+which is what a queued record feeds. Hiding the miss also destroys the only
+signal the loop runs on.
+
+## What the detectors do NOT do
+
+They do not check that every rule was followed. Most obligations here are
+model-carried and unobservable from a transcript; guessing at them would
+manufacture defects and flood the queue. A new detector must fire on a real
+recorded failure **and** stay silent on its near-miss.
+
+## Privacy — fail-closed by construction
+
+A record carries a class, a sanitized evidence span and a counter, and has **no
+field** that can hold a prompt, a file body, or a project path. It passes the
+audited privacy floor before leaving the machine; a refusal downgrades it to
+local-only rather than scrubbing it into publishable shape — the same principle
+as [`domain-safety-pii`](domain-safety-pii.md) § Surface 2.
+
+## When NOT to fire
+
+The user is criticising the **code**, not the agent's conduct; the fingerprint
+is already an open record (the hook increments it); or a one-off caused by
+information the agent could not have had — note it, do not queue it.
+
+## Enforcement
+
+The hook is `fail_closed: false` and always exits 0: it records, it never
+gates — blocking a turn-end on a heuristic is the failure mode the
+enforcement-projection null warns about. Detection is hook-carried, analysis and
+fix model-carried; only the privacy gate and route choice are deterministic.
+Nothing claims a defect *will* be caught — only that a caught one is not dropped.
+Whether the hook is bound at all on this host is `agent-config hooks:status`; on
+a host with no matching slot the detection half does not run and only the
+model-carried half remains.
+
+## See also
+
+- [`non-destructive-by-default`](non-destructive-by-default.md) — the Hard Floor the release step obeys.
+- [`skill-improvement-pipeline`](../skills/skill-improvement-pipeline/SKILL.md) — the sibling loop for capability gaps.
+- [`upstream-contribute`](../skills/upstream-contribute/SKILL.md) — the manual path this automates.
+- [`council-availability`](council-availability.md) — the defect class that motivated the first detector.

package/dist/agent-src/rules/senior-engineering-discipline.md

@@ -25,6 +25,8 @@ collision_ok:
   "implement": "implementation = the invisible-controls checklist"
   "endpoint": "endpoint row of the surface-to-controls table"
   "component": "component work = generalize + reuse duty"
+# obligation: line 69
+obligation_frequency: "per-edit"
 ---
 
 # Senior Engineering Discipline

package/dist/agent-src/rules/session-canary.md

@@ -12,6 +12,11 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 enforced_by:
   - "hook:session-canary"
+# obligation: line 31
+obligation_frequency: "per-task"
+# frequency-override: the per-turn phrases in the body describe the CARRIER
+# (a per-turn beat is the closest reachable cover for a per-task obligation),
+# not the obligation itself, which is still the first reply of each new task.
 collision_ok:
   "canary_name": "this rule owns what the NAME does once set and which of the three layers already supplies it; settings-ask-protocol owns how it is asked for and where the answer goes"
 ---
@@ -69,25 +74,63 @@ name it and suggest a fresh session or `/agent-handoff`, per
 - The greeting never substitutes for substance — it prefixes the answer, it is
   not the answer.
 
-## Enforcement — per session, NOT per task
-
-> **Enforced by:** [`scripts/session_canary_hook.ts`](../../scripts/session_canary_hook.ts)
-> (`session_start`, all hook-capable hosts) — injects the `<session-canary>`
-> contract block into every new session, so a fresh conversation cannot start
-> without it. **Copilot fallback:** no hook surface — this rule is the only
-> carrier; re-read it when the trigger fires.
-
-**The gap, stated because it was measured.** The injection fires on
-`session_start`; the obligation is per *task*. Nothing re-injects at a task
-boundary, so from the second task on the contract is model-carried.
-
-Conformance audit, 30 sessions, 2026-08-06: opening canary dropped on ~13 of 15
-task starts, often present only in the closing summary, twice carrying a name
-the settings chain did not resolve; the honesty clause fired zero times. No
-per-task gate ships — the audit found no harm beyond the lost signal, and a
-mechanism for a signal whose absence nobody acted on has no failure mode to
-match. The consequence stands: this canary cannot currently be relied on as the
-degradation detector its own rationale describes.
+## Enforcement — per turn, which is the closest reachable cover for per task
+
+> **Enforced by:** [`scripts/session_canary_hook.ts`](../../scripts/session_canary_hook.ts),
+> bound in **two** slots. `session_start` injects the full `<session-canary>`
+> contract once, so a fresh conversation cannot start without it.
+> `user_prompt_submit` injects a one-line beat every turn, which is what
+> actually reaches a task boundary. Both bindings are manifest facts; whether
+> they are live on this install is `agent-config hooks:status`.
+
+**Why two slots, and why not one.** The obligation is per *task*. No host has a
+per-task slot — Cline maps `TaskStart`/`TaskResume` onto `session_start`, and
+Claude Code has no task event at all — so "move the carrier to the right slot"
+was never available. Per-turn is a strict superset of per-task and is reachable,
+which is the whole argument: over-firing a greeting is a visible, cheap failure;
+under-firing is the silent one. The full contract stays at session scope because
+re-injecting ~800 characters every turn would buy the same coverage at roughly
+40× the tokens over a long session.
+
+**What that fixed, stated because it was measured.** Conformance audit, 30
+sessions, 2026-08-06, under session-scope-only injection: opening canary dropped
+on ~13 of 15 task starts, often present only in the closing summary, twice
+carrying a name the settings chain did not resolve; the honesty clause fired
+zero times. The frequency join in `check_enforcement_coverage.ts` now reports the
+carrier as covering the obligation — which is a claim about firing, not about
+compliance.
+
+**What the second audit found: the carrier fires and compliance did not
+follow.** Conformance round 5, 2026-08-07, reading the five highest-turn
+sessions with the carrier bound per turn: opening canary dropped on **24 of 29**
+task starts, the honesty clause fired **0** times, and the wrong name was
+emitted **twice** — "Mathias", which resolves from no layer of the chain
+(`identity.name` is `Matze`, `git config user.name` is `matze4u`), i.e. inferred
+from the ambient environment rather than read from settings. 24/29 against the
+earlier 13/15 is not a fall, and the two windows are not identical, so they are
+stated side by side rather than as a trend — but nothing here supports the claim
+that the miss rate moved. A reminder in context is therefore not a mechanism for
+this obligation: at higher frequency it is the same request, more often.
+
+**What the next mechanism has to be.** Not another injection. It has to be able
+to **refuse** — a check at delivery (`stop` is block-capable on this host, so a
+refused turn-end continues in the same turn) that rejects a task-start reply
+carrying no greeting. Proposed, not shipped; until it is, this obligation is
+model-carried in practice, whatever the frequency join reports.
+
+**The wrong-name half needs nothing, and that is worth stating.** The beat
+already carries the resolved value — `build_canary_reminder` emits
+`Canary active for "<name>"`, and the hook no-ops when no layer resolves a name —
+and both wrong-name occurrences predate it: 2026-08-04, where the per-turn beat
+landed 2026-08-06. The inference path they measure is already closed, so a third
+audit should not re-open it.
+
+**Two declared gaps, neither papered over.** On **Augment** there is no
+`user_prompt_submit` slot; its `stop` fires *after* the reply, so injecting
+there could not shape the reply the reminder is for, and counting it would be
+exactly the over-credit the frequency audit exists to remove. Augment therefore
+reports as an open gap rather than as covered. **Copilot** has no hook surface at
+all — this rule is the only carrier there; re-read it when the trigger fires.
 
 ## See also
 

package/dist/agent-src/rules/settings-ask-protocol.md

@@ -25,6 +25,10 @@ enforced_by:
   - "none"
 collision_ok:
   "canary_name": "the nickname ask is this protocol's canonical B-class instance — session-canary owns what the NAME then does and which layers already supply it, this rule owns how it is asked for and where the answer goes"
+# obligation: line 39
+obligation_frequency: "per-task"
+# frequency-override: the per-turn phrase at line 175 is a See-also cross-reference to
+# ask-when-uncertain's rule, not this rule's own obligation, which is per command execution.
 ---
 
 # Settings-Ask Protocol

package/dist/agent-src/rules/size-enforcement.md

@@ -5,6 +5,8 @@ description: "Creating or editing rules, skills, commands, guidelines, AGENTS.md
 alwaysApply: false
 workspaces: [agent-config-maintainer]
 packs: [meta]
+# obligation: line 21
+obligation_frequency: "per-edit"
 ---
 
 # size-enforcement

package/dist/agent-src/rules/skill-improvement-trigger.md

@@ -10,6 +10,8 @@ routes_to:
   - "skill:skill-improvement-pipeline"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+# obligation: line 17
+obligation_frequency: "per-task"
 ---
 
 # Skill Improvement Trigger

package/dist/agent-src/rules/skill-quality.md

@@ -12,6 +12,8 @@ enforced_by:
   - "validator:src/scripts/skill_linter.ts"
 collision_ok:
   "src/skills/": "every skill edit passes the executable-quality floor"
+# obligation: line 14
+obligation_frequency: "per-edit"
 ---
 
 # Skill Quality

package/dist/agent-src/rules/slash-command-routing-policy.md

@@ -11,6 +11,8 @@ routes_to:
   - "skill:command-routing"
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
+# obligation: line 18
+obligation_frequency: "per-turn"
 ---
 
 # Slash Command Routing Policy

package/dist/agent-src/rules/source-confidentiality.md

@@ -23,6 +23,8 @@ collision_ok:
   "src/skills/": "skill prose must not name derivation sources"
   "src/rules/": "rule prose must not name derivation sources"
   "agents/roadmaps/": "harvest/comparison roadmaps stay anonymized"
+# obligation: line 46
+obligation_frequency: "per-edit"
 ---
 
 # Source Confidentiality

package/dist/agent-src/rules/source-discovery-gate.md

@@ -20,6 +20,8 @@ packs: [engineering-base]
 collision_ok:
   "endpoint": "an unconfirmed endpoint shape needs evidence before code"
   "schema": "a DB schema is the canonical structure to verify from a real source"
+# obligation: line 44
+obligation_frequency: "per-edit"
 ---
 
 # Source Discovery — evidence before structure

package/dist/agent-src/rules/source-of-truth.md

@@ -16,6 +16,8 @@ enforced_by:
   - "validator:src/scripts/check_condensation.ts"
 collision_ok:
   ".augment/": "the projection is read-only — edits belong in src/"
+# obligation: line 44
+obligation_frequency: "per-edit"
 ---
 
 # Source of Truth

package/dist/agent-src/rules/spreadsheet-source-quality.md

@@ -14,6 +14,8 @@ workspaces:
   - finance
 packs:
   - finance-basic
+# obligation: line 49
+obligation_frequency: "per-edit"
 ---
 
 # Spreadsheet Source Quality

package/dist/agent-src/rules/strategy-safety-floor.md

@@ -35,13 +35,15 @@ trust:
   human_review_required: true
 collision_ok:
   "category": "'category' is positioning vocabulary (category design) in the strategy pack"
+# obligation: line 55
+obligation_frequency: "per-task"
 ---
 <!-- agent-config:human-review-banner -->
 > HUMAN REVIEW REQUIRED · trust: advisory · owner: unknown
 
 # Strategy Safety Floor
 
-Domain safety floor for founder-strategy artefacts (vision, positioning, competitive moats, market entry, OKR trees, build-vs-buy). Auto-activates when `pack-founder-strategy` is installed.
+Domain safety floor for founder-strategy artefacts (vision, positioning, competitive moats, market entry, OKR trees, build-vs-buy). Auto-activates when `pack-founder-strategy` is installed — `agent-config packs:active` says whether it is, and names the degraded case where zero packs load and this floor cannot activate at all.
 
 ## Iron Law — strategy is a frame, not a verdict
 

package/dist/agent-src/rules/symfony-routing.md

@@ -16,6 +16,8 @@ trust:
 install:
   default: false
   removable: true
+# obligation: line 23
+obligation_frequency: "none"
 ---
 
 # Symfony Routing

package/dist/agent-src/rules/think-before-action.md

@@ -22,6 +22,8 @@ collision_ok:
   "implement": "analyze-first floor on any implementation"
   "debug": "targeted inspection over brute force while debugging"
   "fix": "no blind trial-and-error on fixes — max 2 retries"
+# obligation: line 50
+obligation_frequency: "per-edit"
 ---
 
 # think-before-action

package/dist/agent-src/rules/token-budget-discipline.md

@@ -8,6 +8,8 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer]
 packs: [meta]
+# obligation: line 43
+obligation_frequency: "per-edit"
 ---
 
 # Token Budget Discipline
@@ -30,7 +32,9 @@ TO THE FULL FRUGALITY CANON (telegraph-speak, thin-projector).
 | `standard` | — | Balanced condensation | Not trimmed if priority ≥ 60 | 500–2000 tokens |
 | `rich` | Must be declared + justified | **Exempt** | **Never trimmed** | 2000–3500 tokens |
 
-Read `tokens.rich_skills` from `.agent-settings.yml` (default `on`) to determine
+Read `tokens.rich_skills` from `.agent-settings.yml` (default `on`) — the project
+layer of a cascade that starts user-global, so `agent-config settings:get
+tokens.rich_skills` is the read that answers it, file included — to determine
 whether rich skills may load in full. If `off`, treat them as `standard`. If
 `ask`, the question's shape is
 [`settings-ask-protocol`](settings-ask-protocol.md)'s, not this rule's; what only

package/dist/agent-src/rules/token-efficiency.md

@@ -11,6 +11,8 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
+# obligation: line 21
+obligation_frequency: "per-edit"
 ---
 
 # Token Efficiency

package/dist/agent-src/rules/token-optimizer-maintenance.md

@@ -19,6 +19,8 @@ workspaces: [agent-config-maintainer]
 packs: [meta]
 enforced_by:
   - "validator:src/scripts/check_token_optimizer_freshness.ts"
+# obligation: line 29
+obligation_frequency: "per-commit"
 ---
 
 # Token Optimizer Maintenance

package/dist/agent-src/rules/tool-safety.md

@@ -10,6 +10,8 @@ workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
 enforced_by:
   - "validator:src/scripts/lint_agent_security.ts"
+# obligation: line 19
+obligation_frequency: "per-edit"
 ---
 
 # Tool Safety
@@ -23,7 +25,11 @@ Tools are permissions, not abilities. Every tool access must be declared and rev
 ## Constraints
 
 - **Deny by default** — no tool access unless explicitly listed in `allowed_tools`
-- **Allowlist only** — tool names must match the tool registry
+- **Allowlist only** — tool names must match the tool registry. That registry is
+  a small static constant and is **not** the same thing as the MCP servers a
+  session can reach; `agent-config mcp:available` prints both, kept apart, and
+  says plainly that it performs no handshake. Conflating the two is how a skill
+  ends up declaring a tool nothing provides.
 - **Read-first** — prefer read-only actions; write requires explicit approval
 - **No hidden credentials** — tools must not embed API keys or tokens in skill files
 - **No arbitrary execution** — tool adapters have fixed interfaces, not free-form calls

package/dist/agent-src/rules/ui-audit-gate.md

@@ -14,11 +14,15 @@ routes_to:
   - "skill:typography-system"
 workspaces: [agent-config-maintainer, engineering]
 packs: [frontend-design]
+enforced_by:
+  - "none"
 collision_ok:
   "component": "no new component without audit findings — its core subject"
   "design token": "same surface, opposite side: this inventories tokens before the write, design-review-after-ui-write reviews what the write emitted"
   "resources/views/": "both halves of one UI loop fire on the same path — audit before, review after; neither substitutes for the other"
   "resources/js/": "both halves of one UI loop fire on the same path — audit before, review after; neither substitutes for the other"
+# obligation: line 39
+obligation_frequency: "per-edit"
 ---
 
 # UI Audit Gate

package/dist/agent-src/rules/untrusted-input-defense.md

@@ -19,6 +19,8 @@ workspaces: [engineering]
 packs: [engineering-base]
 enforced_by:
   - "none"
+# obligation: line 38
+obligation_frequency: "per-event"
 ---
 
 <!-- security-lint: allow instruction-smuggling "defense rule: quotes role-takeover phrases (ignore previous instructions, you are now, <IMPORTANT>) to teach refusal" -->

package/dist/agent-src/rules/upstream-proposal.md

@@ -10,6 +10,8 @@ routes_to:
   - "skill:upstream-contribute"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+# obligation: line 17
+obligation_frequency: "per-task"
 ---
 
 # Upstream Proposal

package/dist/agent-src/rules/user-interaction.md

@@ -13,6 +13,8 @@ triggers:
 self_contained: true
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
+# obligation: line 40
+obligation_frequency: "per-turn"
 ---
 
 # User Interaction

package/dist/agent-src/rules/user-interrupt-priority.md

@@ -18,6 +18,8 @@ load_context:
 self_contained: true
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
+# obligation: line 38
+obligation_frequency: "per-turn"
 ---
 
 # User-Interrupt Priority

package/dist/agent-src/skills/adversarial-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: high
 name: adversarial-review
-description: "ONLY on a request for adversarial review, devil's advocate, stress-test, or honest critique ('poke holes', 'be brutal', 'was hältst du davon') — NOT routine code/design review."
+description: "Adversarial critique — devil's advocate, stress-test, honest teardown ('poke holes', 'be brutal', 'was hältst du davon'); explicit request only. Routine code or design review → code-review."
 personas:
   - critical-challenger
 domain: quality

package/dist/agent-src/skills/analysis-autonomous-mode/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: high
 name: analysis-autonomous-mode
-description: "ONLY when user explicitly requests autonomous analysis, deep investigation, multi-step research, or 'dig into this end-to-end without asking me each step' — NOT for normal feature work."
+description: "Autonomous multi-step investigation — deep research carried end-to-end without per-step approval; explicit request only, never for normal feature work."
 domain: discovery
 workspaces:
   - agent-config-maintainer

package/dist/agent-src/skills/performance-analysis/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: high
 name: performance-analysis
-description: "ONLY when user explicitly requests: performance audit, bottleneck analysis, or N+1 query detection. NOT for regular feature work."
+description: "Performance audit — bottleneck profiling, N+1 query detection, hot-path analysis; explicit request only, not part of regular feature work."
 personas:
   - performance-engineer
 domain: discovery

package/dist/agent-src/skills/persona-improvement/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: persona-improvement
-description: "ONLY when the user explicitly asks to refine a persona from recent corrections — persona analog of skill-improvement-pipeline; tightens a persona's Unique Questions, governance-gated."
+description: "Refine a persona from recent corrections — tightens its Unique Questions, governance-gated; explicit request only. Skill analog → skill-improvement-pipeline."
 domain: process
 execution:
   type: assisted

package/dist/agent-src/skills/project-analyzer/SKILL.md

@@ -2,7 +2,7 @@
 model_tier: high
 context: large
 name: project-analyzer
-description: "ONLY when user asks for single-pass tech-stack detection or `agents/evidence/analysis/` write-up. Deep multi-pass audit → `universal-project-analysis`. Raw primitives → `project-analysis-core`."
+description: "Single-pass tech-stack detection with an agents/evidence/analysis/ write-up; explicit request only. Deep multi-pass audit → universal-project-analysis. Raw primitives → project-analysis-core."
 domain: discovery
 workspaces:
   - engineering

package/dist/agent-src/skills/security-audit/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: high
 name: security-audit
-description: "ONLY when user explicitly requests: security audit, vulnerability scan, or penetration test review. NOT for regular feature work."
+description: "Security audit — vulnerability scan, pentest review, attack-surface sweep; explicit request only, not regular feature work. Pre-implementation threat pass → threat-modeling."
 domain: quality
 parallelizable: files
 workspaces:

package/dist/agent-src/skills/sequential-thinking/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: high
 name: sequential-thinking
-description: "ONLY when user explicitly requests: step-by-step reasoning, structured problem decomposition, or iterative analysis. NOT for regular coding tasks."
+description: "Structured step-by-step problem decomposition and iterative analysis; explicit request only, never for regular coding tasks, and at most once per task."
 domain: process
 workspaces:
   - agent-config-maintainer

package/dist/agent-src/skills/skill-improvement-pipeline/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: inherit
 name: skill-improvement-pipeline
-description: "ONLY when user explicitly requests: run the skill improvement pipeline after a learning was detected. Orchestrates capture, classify, create, validate, and apply."
+description: "Run the skill-improvement pipeline after a learning was detected — capture, classify, create, validate, apply; explicit request only."
 domain: process
 execution:
   type: assisted

package/dist/agent-src/skills/universal-project-analysis/SKILL.md

@@ -2,7 +2,7 @@
 model_tier: high
 context: large
 name: universal-project-analysis
-description: "ONLY when user asks for deep multi-pass codebase audit — orchestrator routing to `project-analysis-core` + framework-specific `project-analysis-*`. Single-pass scan → `project-analyzer`."
+description: "Deep multi-pass codebase audit — orchestrates project-analysis-core plus the framework-specific project-analysis-*; explicit request only. Single-pass scan → project-analyzer."
 domain: discovery
 workspaces:
   - engineering