@event4u/agent-config 9.27.0 → 9.29.0

package/dist/agent-src/rules/brand-source-of-truth.md

@@ -29,7 +29,7 @@ obligation_frequency: "per-edit"
 A precedence rule plus its validation gate (merged from the former
 `brand-consistency` rule, 2026-08-04 — the pair shared triggers and one
 subject). When a consumer already has a brand — registered tokens
-(`.tokens.json`), a voice profile, a brand guide — that brand is authoritative
+(`tokens.json`), a voice profile, a brand guide — that brand is authoritative
 for the run. The curated `brand` corpus (archetypes, colour psychology, type
 principles) is a **gap-filler**, never an override.
 
@@ -55,10 +55,32 @@ OR A VOICE RULE. A VALUE THAT TRACES TO NEITHER IS OFF-BRAND.
 NEVER SHIP AN ASSET THE ACTIVE BRAND CANNOT ACCOUNT FOR.
 ```
 
+## Where the brand actually lives — and how to check
+
+```
+NEVER INFER BRAND PRESENCE FROM A FILENAME. RUN `agent-config brand:status`.
+THE FILE IS `tokens.json`, NEVER `.tokens.json` — A DOT-PREFIXED FILE IS READ BY NOTHING.
+```
+
+The resolver searches exactly four paths under the project root, in this order,
+first hit wins (`BRAND_TOKEN_PATHS`, the UI scaffold directive):
+
+1. `tokens.json`
+2. `assets/tokens.json`
+3. `resources/tokens.json`
+4. `agents/settings/brand/tokens.json` <!-- ref-ignore -->
+
+`agent-config brand:status` reports which one holds a file, or that none does —
+and separately flags a dot-prefixed `.tokens.json`, which is the file a reader
+of this rule's earlier wording would plausibly have created and which nothing
+reads. Absent is a real answer: it means the greenfield branch below, not a
+misconfiguration.
+
 ## Precedence order
 
-1. **Consumer brand profile** — registered `.tokens.json`, voice profile, brand
-   guide, or a confirmed `brand-strategy` / `brand-identity` constraint set.
+1. **Consumer brand profile** — a registered `tokens.json` at one of the four
+   paths above, a voice profile, a brand guide, or a confirmed `brand-strategy`
+   / `brand-identity` constraint set.
 2. **This run's confirmed decisions** — selections the human signed off this session.
 3. **The brand corpus** — archetype / colour / type / messaging defaults, used
    only where 1 and 2 are silent, and always surfaced as corpus-sourced.
@@ -66,7 +88,7 @@ NEVER SHIP AN ASSET THE ACTIVE BRAND CANNOT ACCOUNT FOR.
 ## What the gate covers
 
 - **Colour / type / spacing** in generated UI or assets that is not one of the
-  active brand tokens (from `state.ui_design` or the consumer's `.tokens.json`).
+  active brand tokens (from `state.ui_design` or the consumer's `tokens.json`).
   A raw hex / font / px value with no token behind it is off-brand.
 - **Copy and microcopy** whose register contradicts the active voice profile
   (e.g. playful copy under an authoritative `Ruler` voice).
@@ -79,7 +101,7 @@ NEVER SHIP AN ASSET THE ACTIVE BRAND CANNOT ACCOUNT FOR.
 - **Precedence half:** any brand decision while a consumer brand profile is
   present — to keep the corpus from quietly replacing a value the brand already
   defines.
-- **Gate half:** a brand layer is active for the run (a `.tokens.json` /
+- **Gate half:** a brand layer is active for the run (a `tokens.json` /
   `state.ui_design` brand profile or a confirmed `brand-strategy` /
   `brand-identity` constraint set) AND a UI / copy / asset is being emitted or
   reviewed.
@@ -114,6 +136,11 @@ for the full Brand-mode vs Product-mode discriminator.
 - [`brand-consistency`](brand-consistency.md) — pointer stub; its body lives here since the 2026-08-04 merge.
 - [`brand`](../skills/brand/SKILL.md) — the gap-fill corpus this rule subordinates to consumer brand.
 - [`brand-identity`](../skills/brand-identity/SKILL.md) — defines the tokens the gate validates against.
-- [`brand-to-tokens`](../skills/brand-to-tokens/SKILL.md) — emits the DTCG `.tokens.json` source of truth.
+- [`brand-to-tokens`](../skills/brand-to-tokens/SKILL.md) — emits the DTCG token
+  source of truth. **Known contradiction, recorded not resolved:** that skill's
+  prose says to author `.tokens.json` while the only resolver in the tree reads
+  `tokens.json`, so a consumer following it literally produces a file nothing
+  loads. The authoring name is a consumer-visible decision and is not changed
+  here; `brand:status` surfaces the mismatch at the moment it matters.
 - [`design-intelligence`](../skills/design-intelligence/SKILL.md) — the "audit findings outrank corpus" precedent the gate mirrors.
 - [`docs/guidelines/design-modes.md`](../docs/guidelines/design-modes.md) — brand vs product register discriminator and routing.

package/dist/agent-src/rules/context-hygiene.md

@@ -19,7 +19,9 @@ obligation_frequency: "per-turn"
 # Context Hygiene
 
 > **Enforced by:** [`scripts/context_hygiene_hook.ts`](../../scripts/context_hygiene_hook.ts)
-> on Augment + Claude Code (`PostToolUse`). The hook maintains
+> on Augment + Claude Code (`PostToolUse`). Run `agent-config hooks:status` to
+> see whether that slot is actually bound on the host you are on — this line is
+> a statement about the manifest, not about your install. The hook maintains
 > `agents/state/context-hygiene.json` (tool-call count, loop signal,
 > freshness milestones at 20/40/60); the prose below is the spec the
 > hook implements and the agent-side fallback.

package/dist/agent-src/rules/council-availability.md

@@ -0,0 +1,93 @@
+---
+type: "auto"
+tier: "2a"
+description: "Council availability is decided by the CLI resolver, never by the project tree — .agent-settings.yml is not the council config"
+triggers:
+  - keyword: "council"
+  - keyword: "ai council"
+  - keyword: "ai-council"
+  - keyword: "council:status"
+  - keyword: "second opinion"
+  - phrase: "cross-check with another model"
+self_contained: true
+workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
+packs: [meta]
+enforced_by:
+  - "none"
+# obligation: line 27
+obligation_frequency: "per-task"
+---
+
+# Council Availability Is CLI-Decided
+
+The council config is user-global (ADR-104): configured once per developer, live
+in every project, worktree and CWD — including consumer repos carrying none of
+this package's internals. Nothing in the project tree switches it on or off.
+
+## The Iron Law
+
+```
+COUNCIL AVAILABILITY IS DECIDED BY THE CLI RESOLVER — NEVER BY THE PROJECT TREE.
+RUN THE FREE `council:status` PROBE BEFORE CLAIMING THE COUNCIL IS UNAVAILABLE.
+NEVER INFER "NOT CONFIGURED" FROM A MISSING `.agent-settings.yml`, A MISSING
+`scripts/ai_council`, OR A MISSING PROJECT-LOCAL COUNCIL FILE — NONE OF THEM
+CARRY COUNCIL ENABLEMENT.
+NEVER COPY THE USER-GLOBAL CONFIG INTO THE PROJECT TREE TO "MAKE IT WORK".
+NEVER PRESENT A SUBAGENT FAN-OUT AS A COUNCIL.
+```
+
+## The probe
+
+```bash
+agent-config council:status     # no API call, no spend, any directory
+```
+
+Prints `CONFIGURED` / `NOT CONFIGURED`, the resolved path, the layer that
+resolved it, and the member count. In this package's own checkout:
+`./scripts-run src/scripts/council_cli status`.
+
+## What says nothing about availability
+
+A missing `.agent-settings.yml` (it never carried enablement — the block was
+removed in ADR-093), a missing `scripts/ai_council/` (package-internal, absent
+from every consumer), a missing project-local council file (the resolver ignores
+`project_root` entirely), and invisible API keys (they live under
+`~/.event4u/agent-config/`). The one real location is
+`~/.event4u/agent-config/settings/.ai-council.yml`; the only escape is
+`$AI_COUNCIL_CONFIG`, an explicit absolute path — still not a project search.
+
+## Why this rule exists
+
+The council switch is **not** in `.agent-settings.yml`, though roughly twenty
+rules train the reflex of reading that file to learn whether a feature is on.
+The exception lived only in [`ai-council`](../skills/ai-council/SKILL.md),
+a skill body that reaches context only on activation, so five consumer sessions
+inspected the tree, announced "council not configured", and substituted a
+subagent fan-out while two members were configured the whole time. One copied
+the user-global config into the repo to "make it work".
+
+## If the probe really says unavailable
+
+State the resolver's own message and stop. A subagent fan-out is a legitimate
+substitute **only when named as such** — never as "the council". Same honesty
+boundary as [`evaluator-independence`](evaluator-independence.md).
+
+## When NOT to fire
+
+Availability is already settled this session, or the question is about council
+*content* (findings, synthesis) rather than availability.
+
+## Enforcement
+
+`enforced_by: none` — no gate reads a chat claim. Deterministic instead:
+`check_council_config_location` fails the build when a council surface ties the
+config to `.agent-settings.yml`, which never carried it, or to a project-tree
+path, and its §4 fails when no always-loaded rule carries this fact at all.
+
+## See also
+
+- [`ai-council`](../skills/ai-council/SKILL.md) — the full invocation procedure.
+- [`direct-answers`](direct-answers.md) Iron Law 2 — a live-state fact is never
+  asserted from inspection when an authoritative resolver exists.
+- [`self-repair-loop`](self-repair-loop.md) — catches the claim when it is made
+  anyway.

package/dist/agent-src/rules/cross-source-consistency.md

@@ -61,6 +61,9 @@ OBVIOUS-TO-THE-AGENT ≠ IN-SCOPE.
 a ticket/spec that carries a second source (an attachment, a code reality, or an
 internal contradiction), gated by `consistency.cross_source` in
 `.agent-settings.yml` (`on` default · `auto` = high-confidence only · `off` = inert).
+That file is the project layer of a cascade that starts user-global — never read
+the setting or its absence from it alone; `agent-config settings:get
+consistency.cross_source` reports the value and the file it came from.
 
 **Does NOT fire** on a single clear source with no second source to compare
 against (that is plain vagueness — it belongs to `ask-when-uncertain`), on

package/dist/agent-src/rules/delegation-policy.md

@@ -46,16 +46,18 @@ Only when the activation gate from
 [`auto-orchestration-activation`](../contexts/execution/auto-orchestration-activation.md)
 clears — all of:
 
-- `subagents.enabled` **and** `subagents.auto != off`,
+- `emergency.orchestration_halt` is not set,
 - the host-capability manifest reports `subagent_spawn: true`,
 - the task is classified **delegable** per
   [`auto-dispatch-classification`](../contexts/execution/auto-dispatch-classification.md)
   (≥1 independent, well-specified slice above the size floor).
 
-`subagents.auto: ask` → ask once before dispatching, in the shape
-[`settings-ask-protocol`](settings-ask-protocol.md) fixes (the answer is not
-persisted — `subagents.auto` is class C); `auto: on` → surface the chosen mode
-+ per-subtask tiers in one line. Any gate failing, or `auto: off`, or no host
+Always-on orchestration (road-to-always-on-orchestration Phase 1) removed the
+`subagents.enabled`/`subagents.auto` settings this used to gate on — there is
+no more per-layer on/off setting. A matched delegable signal → dispatch,
+surfacing the chosen mode + per-subtask tiers in one line, never silent. An
+AMBIGUOUS verdict (no enumerated signal matched) → **ask**, always — a verdict
+to the user, never a speculative spawn. The emergency halt, or no host
 primitive → run in-session (clean no-op).
 
 ## What it makes binding
@@ -77,11 +79,37 @@ primitive → run in-session (clean no-op).
    ordered slice never dispatches before its declared parent's return is
    verified. Both per
    [`subagent-steering`](../contexts/execution/subagent-steering.md).
-6. **Record** telemetry after each dispatch — run `orchestration_record`
-   (one validated line: spawn_count, token_delta + provenance, tier, task_class)
-   per [`orchestration-telemetry`](../contexts/execution/orchestration-telemetry.md)
-   § Emit. This is the agent-behavioral capture the savings report reads;
-   skipping it leaves the value-of-orchestration question unmeasured.
+6. **Record** telemetry after each dispatch — on hook-capable hosts the
+   `orchestration-record` concern (`post_tool_use`) emits the line
+   deterministically for every Agent/Task completion; on hosts without the
+   slot, run `orchestration_record` yourself (one validated line: spawn_count,
+   token_delta + provenance, tier, task_class) per
+   [`orchestration-telemetry`](../contexts/execution/orchestration-telemetry.md)
+   § Emit. Measured before the hook existed: 1 of 370 dispatches captured —
+   the model-carried path alone leaves the value question unmeasured.
+
+## Carriers — how this rule reaches a session (and what stays model-carried)
+
+No host runs the tier-2 rule router, so this file's triggers alone never load
+it. The obligation travels on three carriers instead: the always-loaded
+AGENTS.md line (delegate-by-default + end-review), the `delegation-nudge`
+concern on `user_prompt_submit` (runs `classifyTask` on cheap prompt signals
+and injects a one-line verdict ONLY when the classifier says
+`do-in-parallel`/`do-in-steps` — silence otherwise; delivery on
+`user_prompt_submit` is end-to-end verified), and the `end-review-nudge`
+concern on `stop` (ONE `review_skipped` telemetry line per mutating
+no-review session — verified; its advisory line reaches the dispatcher
+output, but host-side forwarding of stop-slot context to the model is
+unverified, so the model-facing end-review carrier is the AGENTS.md line
+plus this telemetry). The
+capability gate itself resolves from the committed host registry merged with a
+live environment probe in `src/scripts/_lib/host_capability.ts`
+(`probeHostCapabilities` — capability is a fact about the host, never a
+settings override). What stays
+model-carried, honestly: the decomposition itself, the per-return
+verification, and every dispatch on hosts without hook slots. The nudges are
+advisory by design — whether they change behaviour is measured by the
+telemetry, not assumed.
 
 ## Scope — does NOT
 

package/dist/agent-src/rules/design-fidelity.md

@@ -72,6 +72,9 @@ decisions already made — treat it like brand tokens, not like inspiration.
 ## Strictness — set by `design.fidelity_mode`
 
 Read `design.fidelity_mode` from `.agent-settings.yml`. Missing → `strict`.
+That file is the project layer of a cascade that starts user-global, so "missing"
+means missing from **every** layer — `agent-config settings:get
+design.fidelity_mode` reports the value and the file it came from.
 
 | Mode | Behaviour |
 |---|---|

package/dist/agent-src/rules/evaluator-independence.md

@@ -99,7 +99,8 @@ id; with no ledger yet, the counter falls back to session scope. And the slot
 itself is not universal: `pre_tool_use` exists on **three** hosts — augment,
 claude, cowork. On cursor, cline, windsurf, gemini and copilot this guard has
 nowhere to bind, so items 1 and 4 join 2 and 3 as model-carried there. The
-frequency join in `check_enforcement_coverage.ts` reports exactly that set.
+frequency join in `check_enforcement_coverage.ts` reports exactly that set, and
+`agent-config hooks:status` answers it for the host you are on right now.
 
 Items 2 and 3 — an honestly chosen scope, and recording the prompt with the
 verdict — are **not** enforced by anything. A narrowed scope is not decidable

package/dist/agent-src/rules/external-code-graph-interop.md

@@ -70,7 +70,8 @@ AND the repo contains a detectable index:
   routing skill: `agent-config code-graph detect|query|affected|path` over the
   native engine or a consumer-shipped index, grep as the stated fallback. On
   hook-capable hosts the PreToolUse `code-graph` nudge surfaces this once per
-  session; on instruction-file hosts this rule is the surface.
+  session; on instruction-file hosts this rule is the surface. Which of the two
+  you are on is `agent-config hooks:status`, not a guess from the host name.
 - [`discovery_graph`](../scripts/discovery_graph.ts) — this suite's OWN artefact
   relation-graph (`affected`/`explain`); the external code-graph is the
   *source-code* analogue this rule defers to for code questions.

package/dist/agent-src/rules/finance-safety-floor.md

@@ -41,7 +41,7 @@ obligation_frequency: "per-task"
 
 # Finance Safety Floor
 
-Domain safety floor for finance-pack artefacts (cash, runway, valuation, scenario, unit economics, forecasting). Auto-activates when `pack-finance-basic` or `pack-finance-advanced` is installed.
+Domain safety floor for finance-pack artefacts (cash, runway, valuation, scenario, unit economics, forecasting). Auto-activates when `pack-finance-basic` or `pack-finance-advanced` is installed — `agent-config packs:active` says whether it is, and names the degraded case where zero packs load and this floor cannot activate at all.
 
 ## Iron Law — no final investment recommendation
 

package/dist/agent-src/rules/git-history-discipline.md

@@ -84,4 +84,4 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 - [`commit-policy`](commit-policy.md) — commits are the user's call; rewriting them is a stronger version of the same restriction.
 - [`token-efficiency`](token-efficiency.md) — Iron Law on burning the user's tokens for cosmetic gain.
 - [`skill:git-workflow`](../skills/git-workflow/SKILL.md) — Safe Squash-After-Push protocol and Divergent-State Recovery decision tree.
-- `git … --no-verify` / `core.hooksPath` overrides — deterministically blocked by the `block-no-verify` PreToolUse guard (`src/scripts/hooks/block_no_verify.ts`, registered in `hook_manifest.yaml`) **on the three hosts that have a `pre_tool_use` slot at all** — augment, claude, cowork. On cursor, cline, windsurf, gemini and copilot the guard has nowhere to bind, so on those hosts the Iron Laws above are model-carried and "deterministically blocked" is not a claim this rule can make. Surfaced by the frequency join in `check_enforcement_coverage.ts`, which reports the per-commit obligation as uncovered on exactly those platforms.
+- `git … --no-verify` / `core.hooksPath` overrides — deterministically blocked by the `block-no-verify` PreToolUse guard (`src/scripts/hooks/block_no_verify.ts`, registered in `hook_manifest.yaml`) **on the three hosts that have a `pre_tool_use` slot at all** — augment, claude, cowork. On cursor, cline, windsurf, gemini and copilot the guard has nowhere to bind, so on those hosts the Iron Laws above are model-carried and "deterministically blocked" is not a claim this rule can make. Surfaced by the frequency join in `check_enforcement_coverage.ts`, which reports the per-commit obligation as uncovered on exactly those platforms. To check the host you are on rather than trusting this sentence, run `agent-config hooks:status`.

package/dist/agent-src/rules/history-discipline.md

@@ -26,7 +26,9 @@ obligation_frequency: "per-edit"
 # History Discipline
 
 Pack floor for the `history-discipline` pack (default-off; auto-activates
-when the pack is installed). Agents get history wrong in both directions:
+when the pack is installed — `agent-config packs:active` says whether it is,
+and names the degraded case where zero packs load and this floor cannot
+activate at all). Agents get history wrong in both directions:
 missing entirely on data that needs it, or over-built as event sourcing
 where a row-level log suffices — and audit tables that themselves grow
 without bound.

package/dist/agent-src/rules/legal-safety-floor.md

@@ -39,7 +39,7 @@ obligation_frequency: "per-task"
 
 # Legal Safety Floor
 
-Domain safety floor for the `legal-review-prep` pack (contract/NDA/DPA review, legal triage). Auto-activates when `pack-legal-review-prep` is installed. Sibling to `finance-safety-floor` / `strategy-safety-floor`. Every output is a **draft to PREPARE for attorney review**, never legal advice. Operating mechanics migrated to [`legal-practice-profile § Legal safety floor`](../skills/legal-practice-profile/SKILL.md) (per P4 of `road-to-kernel-and-router`) — the Iron Laws below stay here.
+Domain safety floor for the `legal-review-prep` pack (contract/NDA/DPA review, legal triage). Auto-activates when `pack-legal-review-prep` is installed — `agent-config packs:active` says whether it is, and names the degraded case where zero packs load and this floor cannot activate at all. Sibling to `finance-safety-floor` / `strategy-safety-floor`. Every output is a **draft to PREPARE for attorney review**, never legal advice. Operating mechanics migrated to [`legal-practice-profile § Legal safety floor`](../skills/legal-practice-profile/SKILL.md) (per P4 of `road-to-kernel-and-router`) — the Iron Laws below stay here.
 
 ## Iron Law — no final legal call
 

package/dist/agent-src/rules/no-pr-progress-comments.md

@@ -25,7 +25,9 @@ EXCEPTION: USER-INVOKED FLOWS ALWAYS RUN.
 EXCEPTION: USER EXPLICITLY ASKED FOR IT THIS TURN.
 ```
 
-Reading `.agent-settings.yml`:
+Reading `.agent-settings.yml` — the project layer of a cascade that starts
+user-global, so "not set" means not set on any layer; `agent-config settings:get
+personal.pr_progress_comments` reports the value and the file it came from:
 
 - Missing key / not set → treat as `false`.
 - `personal.pr_progress_comments: false` (default) → gate fires.

package/dist/agent-src/rules/onboarding-gate.md

@@ -18,7 +18,9 @@ obligation_frequency: "per-session"
 # Onboarding Gate
 
 **Iron Law.** First turn of a project: if `onboarding.onboarded` is
-false in `.agent-settings.yml`, instruct the developer to run
+false in `.agent-settings.yml` — the project layer of a cascade that starts
+user-global, so check it with `agent-config settings:get onboarding.onboarded`
+rather than by opening one file — instruct the developer to run
 `agent-config setup` in their terminal before executing any other
 request. The wizard writes `onboarding.onboarded: true` on `Finish`,
 which silences this rule for subsequent turns.

package/dist/agent-src/rules/roadmap-ci-steps-policy.md

@@ -45,7 +45,10 @@ AND EXECUTION MUST SKIP THEM INLINE WITH [-] AND A REASON.
 ```
 
 When autonomous local-CI runs are disabled in `.agent-settings.yml`
-(`quality.local_auto_run: false` — the shipped template default), every
+(`quality.local_auto_run: false` — the shipped template default; that file is the
+project layer of a cascade that starts user-global, and this key is one where an
+ABSENT value resolves to `true` at its reader and therefore DISABLES this gate —
+`agent-config settings:get quality.local_auto_run` reports both facts), every
 full-pipeline gate run during roadmap work is wasted wall-clock and
 tokens — the remote CI on the PR is the authoritative gate. Roadmaps must
 neither schedule nor execute those gates locally. New CI gates and

package/dist/agent-src/rules/role-mode-adherence.md

@@ -20,7 +20,7 @@ one of the six modes defined in
 [`role-contracts`](../docs/guidelines/agent-infra/role-contracts.md):
 `developer`, `reviewer`, `tester`, `po`, `incident`, `planner`.
 
-Read `roles.active_role` from `.agent-settings.yml` at session start. Empty / missing → rule is inert; do NOT guess a mode.
+Read `roles.active_role` from `.agent-settings.yml` at session start — the project layer of a cascade that starts user-global, so use `agent-config settings:get roles.active_role`, which reports the value and the file it came from, rather than opening one file. Empty / missing → rule is inert; do NOT guess a mode.
 
 When active, every closing output MUST:
 

package/dist/agent-src/rules/scale-discipline.md

@@ -33,7 +33,9 @@ obligation_frequency: "per-edit"
 # Scale Discipline
 
 Pack floor for the `scale-discipline` pack (default-off; auto-activates
-when the pack is installed). AI agents produce functionally correct but
+when the pack is installed — `agent-config packs:active` says whether it is,
+and names the degraded case where zero packs load and this floor cannot
+activate at all). AI agents produce functionally correct but
 scale-hostile persistence code — this rule binds the failure classes to
 deterministic pattern lints where possible and to review advice where not.
 

package/dist/agent-src/rules/self-repair-loop.md

@@ -0,0 +1,103 @@
+---
+type: "auto"
+tier: "2a"
+description: "An observed defect in the agent's own behaviour becomes a queued record and a fix against agent-config — never a silent shrug"
+triggers:
+  - keyword: "self-repair"
+  - keyword: "self-repair-queue"
+  - phrase: "nicht richtig gearbeitet"
+  - phrase: "du hast das falsch"
+  - phrase: "you ignored the rule"
+  - phrase: "that was wrong"
+self_contained: true
+workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
+packs: [meta]
+enforced_by:
+  - "hook:self-repair"
+# obligation: line 28
+obligation_frequency: "per-turn"
+---
+
+# Self-Repair Loop
+
+A defect in how the agent behaved is a defect in **agent-config**, not in the
+user's project. The user should not have to file it, and the next user should
+not meet it again. Two intake paths fill one queue: the user says so
+(`user_prompt_submit`), or a deterministic detector fires at turn end (`stop`).
+
+## The Iron Law
+
+```
+AN OBSERVED DEFECT IN THE AGENT'S OWN BEHAVIOUR IS QUEUED AND FIXED — NEVER SHRUGGED OFF.
+THE DEFECT BELONGS TO AGENT-CONFIG. NEVER "FIX" IT BY EDITING THE USER'S PROJECT.
+CORRECT THE TURN OPENLY IN FRONT OF THE USER. NEVER RE-RUN IT SILENTLY TO HIDE THE MISS.
+THE OUTWARD STEP — PUSH, PR, ISSUE — NEEDS THE USER'S WORD THIS TURN. NO EXCEPTION.
+```
+
+## When the queue line appears
+
+`<self-repair-queue>` is injected at prompt time while records are open. It is
+work, not a notification:
+
+1. **Read it** — `agent-config self-repair:status`, then the newest record
+   under `agents/runtime/self-repair/`.
+2. **Name the surface that failed** — the rule, skill, gate, or missing carrier
+   that allowed the behaviour. A defect with no named surface is an apology,
+   not a fix.
+3. **Author the fix against agent-config** — in a checkout if one exists, so
+   the release can be a pull request; otherwise the report alone becomes an
+   issue.
+4. **Offer the release** — `agent-config self-repair:release <fingerprint>`;
+   `--dry-run` shows route and body without touching the network. Running it is
+   the user's call, per
+   [`non-destructive-by-default`](non-destructive-by-default.md).
+
+## Correct openly, never silently
+
+Reported by the user → redo the task properly in the same turn, visibly, saying
+what changed. Found by a detector → say so at the next opportunity and correct
+it. Forbidden is the hidden version: re-running the turn so the miss never
+surfaces. That mechanism (`attempt → critic → re-attempt`) was benchmarked and
+falsified under ADR-106 — capability Δ = 0, council verdict TERMINAL — and the
+same verdict names the replacement lever: refine the rules on the failure tail,
+which is what a queued record feeds. Hiding the miss also destroys the only
+signal the loop runs on.
+
+## What the detectors do NOT do
+
+They do not check that every rule was followed. Most obligations here are
+model-carried and unobservable from a transcript; guessing at them would
+manufacture defects and flood the queue. A new detector must fire on a real
+recorded failure **and** stay silent on its near-miss.
+
+## Privacy — fail-closed by construction
+
+A record carries a class, a sanitized evidence span and a counter, and has **no
+field** that can hold a prompt, a file body, or a project path. It passes the
+audited privacy floor before leaving the machine; a refusal downgrades it to
+local-only rather than scrubbing it into publishable shape — the same principle
+as [`domain-safety-pii`](domain-safety-pii.md) § Surface 2.
+
+## When NOT to fire
+
+The user is criticising the **code**, not the agent's conduct; the fingerprint
+is already an open record (the hook increments it); or a one-off caused by
+information the agent could not have had — note it, do not queue it.
+
+## Enforcement
+
+The hook is `fail_closed: false` and always exits 0: it records, it never
+gates — blocking a turn-end on a heuristic is the failure mode the
+enforcement-projection null warns about. Detection is hook-carried, analysis and
+fix model-carried; only the privacy gate and route choice are deterministic.
+Nothing claims a defect *will* be caught — only that a caught one is not dropped.
+Whether the hook is bound at all on this host is `agent-config hooks:status`; on
+a host with no matching slot the detection half does not run and only the
+model-carried half remains.
+
+## See also
+
+- [`non-destructive-by-default`](non-destructive-by-default.md) — the Hard Floor the release step obeys.
+- [`skill-improvement-pipeline`](../skills/skill-improvement-pipeline/SKILL.md) — the sibling loop for capability gaps.
+- [`upstream-contribute`](../skills/upstream-contribute/SKILL.md) — the manual path this automates.
+- [`council-availability`](council-availability.md) — the defect class that motivated the first detector.

package/dist/agent-src/rules/session-canary.md

@@ -80,7 +80,8 @@ name it and suggest a fresh session or `/agent-handoff`, per
 > bound in **two** slots. `session_start` injects the full `<session-canary>`
 > contract once, so a fresh conversation cannot start without it.
 > `user_prompt_submit` injects a one-line beat every turn, which is what
-> actually reaches a task boundary.
+> actually reaches a task boundary. Both bindings are manifest facts; whether
+> they are live on this install is `agent-config hooks:status`.
 
 **Why two slots, and why not one.** The obligation is per *task*. No host has a
 per-task slot — Cline maps `TaskStart`/`TaskResume` onto `session_start`, and

package/dist/agent-src/rules/settings-ask-protocol.md

@@ -7,7 +7,6 @@ triggers:
   - keyword: "settings:set"
   - keyword: "canary_name"
   - keyword: "rich_skills"
-  - keyword: "budget_routing"
   - keyword: "adversarial_council"
   - keyword: "learn_on_session_end"
   - keyword: "open_edited_files"
@@ -34,7 +33,7 @@ obligation_frequency: "per-task"
 # Settings-Ask Protocol
 
 A settings question is the one ask where the agent poses the question *and* owns
-where the answer goes. Nine keys can produce one, in two mechanisms that look
+where the answer goes. Seven keys can produce one, in two mechanisms that look
 identical from outside and differ completely underneath.
 
 ## The Iron Law
@@ -70,7 +69,7 @@ How long it stays cached in working state is the key's own business, and several
 keys state their own scope. Reading the C path as "re-ask every execution" would
 turn a fence against illegal writes into a source of extra questions.
 
-## The nine keys
+## The seven keys
 
 **Class B — persist once**: `personal.canary_name` ·
 `personal.open_edited_files` · `memory.learn_on_session_end`. Each ships a
@@ -78,10 +77,12 @@ conservative default (`""`, `false`, `false`), so absent is indistinguishable
 from *no* and never from *yes*.
 
 **Class C carrying an `ask` value in its own enum** — a runtime question whose
-answer dies with the run: `subagents.budget_routing` and `worktrees.mode` (both
-**ship** as `ask`), plus `tokens.rich_skills`, `subagents.auto`,
-`subagents.adversarial_council`, `decision_engine.on_block` (which can be set to
-`ask` by a human but do not ship that way).
+answer dies with the run: `worktrees.mode` (**ships** as `ask`), plus
+`tokens.rich_skills`, `subagents.adversarial_council`, `decision_engine.on_block`
+(which can be set to `ask` by a human but do not ship that way). Always-on
+orchestration (road-to-always-on-orchestration Phase 1) deleted
+`subagents.auto` and `subagents.budget_routing` — the layer no longer carries a
+setting for this protocol to route.
 
 ## The budget
 

package/dist/agent-src/rules/strategy-safety-floor.md

@@ -43,7 +43,7 @@ obligation_frequency: "per-task"
 
 # Strategy Safety Floor
 
-Domain safety floor for founder-strategy artefacts (vision, positioning, competitive moats, market entry, OKR trees, build-vs-buy). Auto-activates when `pack-founder-strategy` is installed.
+Domain safety floor for founder-strategy artefacts (vision, positioning, competitive moats, market entry, OKR trees, build-vs-buy). Auto-activates when `pack-founder-strategy` is installed — `agent-config packs:active` says whether it is, and names the degraded case where zero packs load and this floor cannot activate at all.
 
 ## Iron Law — strategy is a frame, not a verdict
 

package/dist/agent-src/rules/token-budget-discipline.md

@@ -32,7 +32,9 @@ TO THE FULL FRUGALITY CANON (telegraph-speak, thin-projector).
 | `standard` | — | Balanced condensation | Not trimmed if priority ≥ 60 | 500–2000 tokens |
 | `rich` | Must be declared + justified | **Exempt** | **Never trimmed** | 2000–3500 tokens |
 
-Read `tokens.rich_skills` from `.agent-settings.yml` (default `on`) to determine
+Read `tokens.rich_skills` from `.agent-settings.yml` (default `on`) — the project
+layer of a cascade that starts user-global, so `agent-config settings:get
+tokens.rich_skills` is the read that answers it, file included — to determine
 whether rich skills may load in full. If `off`, treat them as `standard`. If
 `ask`, the question's shape is
 [`settings-ask-protocol`](settings-ask-protocol.md)'s, not this rule's; what only
@@ -137,7 +139,7 @@ its obligation on line 300.
 
 ## The size band is measured, and only its ceiling is gated
 
-The `rich` band is **2,000–3,500 tokens** ([ADR-217](../docs/decisions/ADR-217-rich-class-band-measured-and-enforced.md)).
+The `rich` band is **2,000–3,500 tokens** (ADR-217, `docs/decisions/ADR-217-rich-class-band-measured-and-enforced.md`).
 It was 2,000–5,000 and enforced by nothing until that record: measured with the
 exact BPE tokenizer, the largest rich artifact in the tree is 3,331 tokens, so
 the old ceiling described no artifact that existed. An unused permission costs

package/dist/agent-src/rules/tool-safety.md

@@ -25,7 +25,11 @@ Tools are permissions, not abilities. Every tool access must be declared and rev
 ## Constraints
 
 - **Deny by default** — no tool access unless explicitly listed in `allowed_tools`
-- **Allowlist only** — tool names must match the tool registry
+- **Allowlist only** — tool names must match the tool registry. That registry is
+  a small static constant and is **not** the same thing as the MCP servers a
+  session can reach; `agent-config mcp:available` prints both, kept apart, and
+  says plainly that it performs no handshake. Conflating the two is how a skill
+  ends up declaring a tool nothing provides.
 - **Read-first** — prefer read-only actions; write requires explicit approval
 - **No hidden credentials** — tools must not embed API keys or tokens in skill files
 - **No arbitrary execution** — tool adapters have fixed interfaces, not free-form calls

package/dist/agent-src/skills/adversarial-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: high
 name: adversarial-review
-description: "ONLY on a request for adversarial review, devil's advocate, stress-test, or honest critique ('poke holes', 'be brutal', 'was hältst du davon') — NOT routine code/design review."
+description: "Adversarial critique — devil's advocate, stress-test, honest teardown ('poke holes', 'be brutal', 'was hältst du davon'); explicit request only. Routine code or design review → code-review."
 personas:
   - critical-challenger
 domain: quality

package/dist/agent-src/skills/analysis-autonomous-mode/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: high
 name: analysis-autonomous-mode
-description: "ONLY when user explicitly requests autonomous analysis, deep investigation, multi-step research, or 'dig into this end-to-end without asking me each step' — NOT for normal feature work."
+description: "Autonomous multi-step investigation — deep research carried end-to-end without per-step approval; explicit request only, never for normal feature work."
 domain: discovery
 workspaces:
   - agent-config-maintainer