@event4u/agent-config 9.27.0 → 9.29.0

package/src/scripts/self_repair_hook.ts

@@ -0,0 +1,241 @@
+#!/usr/bin/env node
+/**
+ * Self-repair hook — turns an observed agent defect into a queued, fixable
+ * record without the user having to file anything.
+ *
+ * Three slots, one record shape:
+ *
+ *   - `user_prompt_submit` — the user states the agent worked wrongly. Opens a
+ *     `user-reported` record and injects the open-queue line so the agent picks
+ *     the work up in the same turn.
+ *   - `stop` — the finished turn is run past the deterministic detectors. A hit
+ *     opens a `self-detected` record. Nothing is injected here: a reminder that
+ *     fires after the reply cannot shape it, and the queue line at the next
+ *     prompt reaches the same agent one turn later at a fraction of the tokens.
+ *   - every other slot — clean no-op.
+ *
+ * ADVISORY BY CONSTRUCTION (`fail_closed: false`, always exit 0). Blocking a
+ * turn-end on a heuristic is the failure mode the enforcement-projection and
+ * recursive-verification nulls both warn about; this hook records, it does not
+ * gate. The one outward step (push + PR, or an issue) stays behind the
+ * `non-destructive-by-default` Hard Floor and lives in `self_repair_cli.ts`.
+ *
+ * Honest scope: the detector set is small and deterministic on purpose. It
+ * covers the two defect classes the conformance audits actually measured, plus
+ * the user-report path. It does NOT "check all rules were followed" — most
+ * obligations are model-carried and unobservable from a transcript, and a
+ * detector that guessed at them would manufacture defects and flood the queue.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import {
+    type DefectFinding,
+    detectUserReport,
+    runDetectors,
+    type TurnSnapshot,
+} from './_lib/self_repair.js';
+import { openRecords, upsertFinding } from './_lib/self_repair_store.js';
+import { readHookStdin } from './hooks/hook_stdin.js';
+
+const EXIT_ALLOW = 0;
+
+type JsonValue = string | number | boolean | null | JsonValue[] | { [k: string]: JsonValue };
+type JsonObject = { [k: string]: JsonValue };
+
+function isObject(v: unknown): v is JsonObject {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+
+function str(v: JsonValue | undefined): string {
+    return typeof v === 'string' ? v : '';
+}
+
+function workspaceRoot(env: JsonObject): string {
+    const v = env['workspace_root'];
+    return typeof v === 'string' && v ? v : process.cwd();
+}
+
+/**
+ * Last assistant reply + the tool commands of the turn, read from the host's
+ * JSONL transcript. Absent or unreadable transcript → an empty snapshot, which
+ * every detector declines.
+ */
+export function readTurn(transcriptPath: string, pinned: 'de' | 'en' | null): TurnSnapshot {
+    const empty: TurnSnapshot = { prompt: '', reply: '', toolCommands: [], pinnedLanguage: pinned };
+    if (!transcriptPath) {
+        return empty;
+    }
+    let lines: string[];
+    try {
+        lines = fs.readFileSync(transcriptPath, 'utf-8').split('\n');
+    } catch {
+        return empty;
+    }
+    let reply = '';
+    let prompt = '';
+    const toolCommands: string[] = [];
+    for (const raw of lines) {
+        const line = raw.trim();
+        if (!line) {
+            continue;
+        }
+        let obj: unknown;
+        try {
+            obj = JSON.parse(line);
+        } catch {
+            continue;
+        }
+        if (!isObject(obj)) {
+            continue;
+        }
+        const msg = obj['message'];
+        if (!isObject(msg)) {
+            continue;
+        }
+        const content = msg['content'];
+        if (obj['type'] === 'user' && typeof content === 'string') {
+            prompt = content;
+        }
+        if (obj['type'] !== 'assistant') {
+            continue;
+        }
+        if (typeof content === 'string') {
+            reply = content;
+            continue;
+        }
+        if (!Array.isArray(content)) {
+            continue;
+        }
+        const parts: string[] = [];
+        for (const blk of content) {
+            if (!isObject(blk)) {
+                continue;
+            }
+            if (blk['type'] === 'text' && typeof blk['text'] === 'string') {
+                parts.push(blk['text']);
+            }
+            if (blk['type'] === 'tool_use') {
+                const input = blk['input'];
+                const name = str(blk['name']);
+                const cmd = isObject(input) ? str(input['command']) : '';
+                toolCommands.push(`${name} ${cmd}`.trim());
+            }
+        }
+        if (parts.length > 0) {
+            reply = parts.join('\n');
+        }
+    }
+    return { prompt, reply, toolCommands, pinnedLanguage: pinned };
+}
+
+/** The queue line injected at prompt time when records are waiting. */
+export function buildQueueLine(count: number, newest: string): string {
+    return (
+        `<self-repair-queue>${count} open agent-config defect record(s) ` +
+        `(newest: ${newest}). These are defects in the AGENT CONFIG, not in this ` +
+        `project. Per the self-repair rule: analyse the newest record, author the ` +
+        `fix against agent-config, and prepare the release — the outward step ` +
+        `(push + PR, or an issue) still needs the user's word this turn. ` +
+        `Records: agents/runtime/self-repair/</self-repair-queue>`
+    );
+}
+
+function pinnedLanguage(env: JsonObject): 'de' | 'en' | null {
+    const v = str(env['reply_language'] ?? env['language']).toLowerCase();
+    if (v.startsWith('de')) {
+        return 'de';
+    }
+    if (v.startsWith('en')) {
+        return 'en';
+    }
+    return null;
+}
+
+export function main(): number {
+    let env: JsonObject = {};
+    try {
+        const raw = readHookStdin();
+        const parsed: unknown = raw.trim() ? JSON.parse(raw) : {};
+        env = isObject(parsed) ? parsed : {};
+    } catch {
+        // malformed stdin — never block, just no-op below
+    }
+
+    const slot = str(env['event']) || 'session_start';
+    if (slot !== 'user_prompt_submit' && slot !== 'stop') {
+        return EXIT_ALLOW;
+    }
+
+    const root = workspaceRoot(env);
+    const now = new Date().toISOString();
+    const findings: DefectFinding[] = [];
+
+    if (slot === 'user_prompt_submit') {
+        const prompt = str(env['prompt'] ?? env['user_prompt'] ?? env['text']);
+        const f = detectUserReport(prompt);
+        if (f !== null) {
+            findings.push(f);
+        }
+    } else {
+        const tp = str(env['transcript_path'] ?? env['transcriptPath']);
+        findings.push(...runDetectors(readTurn(tp, pinnedLanguage(env))));
+    }
+
+    for (const f of findings) {
+        try {
+            upsertFinding(root, f, now);
+        } catch {
+            // an unwritable store must never cost the user their turn
+        }
+    }
+
+    // Injection happens at prompt time only — see the header note on `stop`.
+    if (slot !== 'user_prompt_submit') {
+        return EXIT_ALLOW;
+    }
+    let open: ReturnType<typeof openRecords>;
+    try {
+        open = openRecords(root);
+    } catch {
+        return EXIT_ALLOW;
+    }
+    if (open.length === 0) {
+        return EXIT_ALLOW;
+    }
+    process.stdout.write(
+        `${JSON.stringify({
+            decision: 'allow',
+            reason: `self-repair: ${open.length} open record(s)`,
+            context: buildQueueLine(open.length, open[0]!.defect_class),
+        })}\n`,
+    );
+    return EXIT_ALLOW;
+}
+
+declare const __AGENT_CONFIG_BUNDLE__: boolean | undefined;
+function isCliEntry(): boolean {
+    if (typeof __AGENT_CONFIG_BUNDLE__ !== 'undefined' && __AGENT_CONFIG_BUNDLE__) {
+        return false;
+    }
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    try {
+        return (
+            fs.realpathSync(fileURLToPath(import.meta.url)) ===
+            fs.realpathSync(path.resolve(process.argv[1]))
+        );
+    } catch {
+        return false;
+    }
+}
+
+if (isCliEntry()) {
+    process.exit(main());
+}

package/src/scripts/team_events_spike.ts

@@ -0,0 +1,271 @@
+#!/usr/bin/env tsx
+/**
+ * Team-event payload shape spike (Phase 5.1, road-to-always-on-orchestration).
+ *
+ * `TaskCreated` / `TaskCompleted` / `TeammateIdle` are documented Claude Code
+ * hook events (agent teams, behind `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS`),
+ * but this repo has never observed a real payload for any of them — the
+ * shapes are documented, not verified. This script is manually startable
+ * ONLY: it is never wired into `hook_manifest.yaml` / `hooks.json`. A
+ * maintainer points a hook command at it (or pipes a captured payload) to
+ * record a SHAPE — field names + JS/JSON types — and never a value.
+ * Privacy by construction: the recursive walk below inspects `typeof` /
+ * `Array.isArray`, nothing else, so there is no code path that could copy a
+ * value into the written report.
+ *
+ * SCOPE OF THE PRIVACY CLAIM (stated honestly, per independent review): the
+ * claim above holds for a payload whose OWN keys are static field names —
+ * true of the three documented envelopes this script targets
+ * (`TaskCreated` / `TaskCompleted` / `TeammateIdle`), where a key is always
+ * a schema name like `task_id` or `teammate_name`. It does NOT hold for a
+ * payload with dynamically-named keys — a map keyed by a file path, a
+ * person's name, or any other runtime value — because `extractShape` walks
+ * `Object.keys()` and records each key verbatim as a "field name". A
+ * dynamic key is not a field name; it is a value wearing a field name's
+ * clothes, and this script would write it into the tracked report exactly
+ * as it would refuse to write a value. Point this script only at the three
+ * documented shapes (or another envelope you have separately confirmed has
+ * static keys) — never at an undocumented payload that might carry a
+ * dynamically-keyed map.
+ *
+ * Usage (only meaningful with the experimental flag set):
+ *
+ *     echo '<payload-json>' | \
+ *       CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1 npx tsx src/scripts/team_events_spike.ts [EventName]
+ *
+ * `EventName` is optional; if omitted, the payload's own `hook_event_name` /
+ * `event` / `eventName` / `event_name` / `type` field is read and matched
+ * against the three known `TEAM_EVENT_NAMES` — an unrecognised value falls
+ * back to `unlabeled-event` rather than copying the raw (payload-supplied)
+ * string into the report, which would itself be writing a value under the
+ * cover of a "name".
+ *
+ * Without the flag: clean one-line skip, exit 0, stdin is never touched.
+ *
+ * Output: appends one dated section per capture to
+ * `agents/evidence/analysis/team-event-shapes.md`.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const _HERE = fileURLToPath(import.meta.url);
+const ROOT = path.resolve(path.dirname(_HERE), '..', '..');
+const OUT_FILE = path.join(ROOT, 'agents', 'evidence', 'analysis', 'team-event-shapes.md');
+
+export const FLAG = 'CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS';
+export const TEAM_EVENT_NAMES = ['TaskCreated', 'TaskCompleted', 'TeammateIdle'] as const;
+
+export interface ShapeEntry {
+    path: string;
+    type: string;
+}
+
+/** JS/JSON type of a value. Reads only `typeof` / `Array.isArray` — never the value. */
+function _typeOf(value: unknown): string {
+    if (value === null) return 'null';
+    if (Array.isArray(value)) return 'array';
+    return typeof value; // 'string' | 'number' | 'boolean' | 'object' | 'undefined'
+}
+
+/**
+ * Walk a parsed JSON payload and record field-name + type only.
+ *
+ * This never returns, prints, or embeds a value — recursion is driven
+ * entirely by structural type and object keys.
+ */
+export function extractShape(value: unknown, prefix = ''): ShapeEntry[] {
+    const entries: ShapeEntry[] = [];
+    const t = _typeOf(value);
+    if (prefix !== '') {
+        entries.push({ path: prefix, type: t });
+    }
+    if (t === 'array') {
+        // An event payload's arrays are homogeneous lists, not fixed tuples —
+        // merge every element's shape under one `[]` path (deduped below).
+        for (const item of value as unknown[]) {
+            entries.push(...extractShape(item, `${prefix}[]`));
+        }
+        return entries;
+    }
+    if (t === 'object') {
+        const obj = value as Record<string, unknown>;
+        for (const key of Object.keys(obj).sort()) {
+            entries.push(...extractShape(obj[key], prefix === '' ? key : `${prefix}.${key}`));
+        }
+    }
+    return entries;
+}
+
+/** De-duplicate by path+type — an array's elements repeat the same shape. */
+function _dedupe(entries: ShapeEntry[]): ShapeEntry[] {
+    const seen = new Set<string>();
+    const out: ShapeEntry[] = [];
+    for (const e of entries) {
+        const key = `${e.path}\u0000${e.type}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        out.push(e);
+    }
+    return out;
+}
+
+/**
+ * Best-effort event-name inference from the payload's own envelope.
+ *
+ * m4 fix (independent-review finding): the envelope field this reads
+ * (`hook_event_name` / `event` / `type` / …) carries a payload-SUPPLIED
+ * string — copying it verbatim into the recorded report is exactly the
+ * "copy a value into the report" this script otherwise refuses to do
+ * (see the module header's privacy claim). Matched against the known
+ * `TEAM_EVENT_NAMES` allowlist instead: a recognised name is safe to
+ * record because it is drawn from three publicly documented, stable
+ * literals, never from the untrusted payload string itself; anything
+ * else returns `null` and the caller falls back to the fixed literal
+ * `'unlabeled-event'`.
+ */
+export function inferEventName(payload: unknown): string | null {
+    if (payload === null || typeof payload !== 'object' || Array.isArray(payload)) return null;
+    const obj = payload as Record<string, unknown>;
+    const known = new Set<string>(TEAM_EVENT_NAMES);
+    for (const key of ['hook_event_name', 'event', 'eventName', 'event_name', 'type']) {
+        const v = obj[key];
+        if (typeof v === 'string' && known.has(v)) return v;
+    }
+    return null;
+}
+
+/** Render one capture as a Markdown section — field names + types only. */
+export function renderShapeReport(eventName: string, entries: ShapeEntry[], observedAt: string): string {
+    const deduped = _dedupe(entries);
+    const rows = deduped.map((e) => `| \`${e.path}\` | ${e.type} |`).join('\n');
+    const table = rows === '' ? '_(empty payload — no fields observed)_' : `| Field | Type |\n|---|---|\n${rows}`;
+    return [`## ${eventName} — observed ${observedAt}`, '', table, ''].join('\n');
+}
+
+function _printGuide(): void {
+    process.stdout.write(
+        [
+            'team-event shape spike (manual, not hook-bound)',
+            '',
+            `${FLAG} is set — recording.`,
+            '',
+            `Observed events: ${TEAM_EVENT_NAMES.join(', ')}`,
+            '',
+            'Pipe one captured JSON payload on stdin — values are never written,',
+            'only field names + types:',
+            '',
+            `  echo '<payload-json>' | ${FLAG}=1 npx tsx src/scripts/team_events_spike.ts [EventName]`,
+            '',
+            `Shapes append to ${path.relative(ROOT, OUT_FILE)}.`,
+            '',
+        ].join('\n'),
+    );
+}
+
+async function _readStdin(): Promise<string> {
+    const chunks: Buffer[] = [];
+    // `for await` streams stdin — a synchronous `readFileSync(0)` EAGAINs
+    // past the pipe buffer on a large payload; this has no such ceiling.
+    for await (const chunk of process.stdin) {
+        chunks.push(chunk as Buffer);
+    }
+    return Buffer.concat(chunks).toString('utf-8');
+}
+
+export interface RunResult {
+    skipped: boolean;
+    reason?: string;
+    eventName?: string;
+    entryCount?: number;
+    outFile?: string;
+}
+
+export interface RunOptions {
+    argv?: string[];
+    env?: NodeJS.ProcessEnv;
+    readStdin?: () => Promise<string>;
+    writeReport?: (section: string) => void;
+    now?: () => string;
+}
+
+/**
+ * Orchestrates the spike. Every side effect is injectable so tests never
+ * touch the real environment, stdin, or the tracked report file.
+ */
+export async function run(opts?: RunOptions): Promise<RunResult> {
+    const env = opts?.env ?? process.env;
+    const argv = opts?.argv ?? process.argv.slice(2);
+    const readStdin = opts?.readStdin ?? _readStdin;
+    const now = opts?.now ?? (() => new Date().toISOString());
+    const writeReport =
+        opts?.writeReport ??
+        ((section: string) => {
+            fs.mkdirSync(path.dirname(OUT_FILE), { recursive: true });
+            fs.appendFileSync(OUT_FILE, section, 'utf-8');
+        });
+
+    if (!env[FLAG]) {
+        const reason = `${FLAG} is not set — teams are experimental and unavailable; skipping.`;
+        process.stdout.write(`${reason}\n`);
+        return { skipped: true, reason };
+    }
+
+    _printGuide();
+    const raw = (await readStdin()).trim();
+    if (raw === '') {
+        const reason = 'no payload received on stdin — nothing recorded.';
+        process.stdout.write(`${reason}\n`);
+        return { skipped: true, reason };
+    }
+
+    let payload: unknown;
+    try {
+        payload = JSON.parse(raw);
+    } catch (e) {
+        const reason = `invalid JSON on stdin: ${(e as Error).message}`;
+        process.stderr.write(`team_events_spike: ${reason}\n`);
+        return { skipped: true, reason };
+    }
+
+    const eventName = argv[0] ?? inferEventName(payload) ?? 'unlabeled-event';
+    const entries = extractShape(payload);
+    const section = renderShapeReport(eventName, entries, now());
+    writeReport(`\n${section}`);
+    const count = _dedupe(entries).length;
+    process.stdout.write(`recorded ${count} field shape(s) for ${eventName} -> ${path.relative(ROOT, OUT_FILE)}\n`);
+    return { skipped: false, eventName, entryCount: count, outFile: OUT_FILE };
+}
+
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection)
+    // makes the raw URLs differ; compare realpaths so the entry guard still
+    // fires when run through a symlink.
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
+if (_isCliEntry() || process.argv[1] === _HERE) {
+    run()
+        .then(() => {
+            // Observational spike, never a gate — always exit 0 on a
+            // completed run (skip or record alike).
+            process.exit(0);
+        })
+        .catch((e: unknown) => {
+            process.stderr.write(`team_events_spike: ${(e as Error).message}\n`);
+            process.exit(1);
+        });
+}

package/src/scripts/team_review_gate_hook.ts

@@ -3,14 +3,36 @@
  * Team Review-Gate governance — `stop` concern (road-to-team-mode Phase 4).
  *
  * Minimal call-site for `src/scripts/ai_team/review_gate.ts`. On Stop it
- * reads the dispatcher envelope, and — ONLY when `ai_team.enabled` AND
- * `ai_team.review_gate.managed` are true — locates the newest stop-gate
- * review job the codex plugin persisted for this session, parses its
- * first-line ALLOW/BLOCK contract, applies the consecutive-BLOCK counter,
- * and prints the circuit-breaker notice (exactly once per trip) to stdout
- * for the dispatch layer to render. With `managed: false` (default) the
- * hook exits 0 without touching anything — byte-identical pre-Phase-4
- * Stop behavior.
+ * reads the dispatcher envelope, and — ONLY when `ai_team.review_gate.managed`
+ * is true — locates the newest stop-gate review job the codex plugin
+ * persisted for this session, parses its first-line ALLOW/BLOCK contract,
+ * applies the consecutive-BLOCK counter, and prints the circuit-breaker
+ * notice (exactly once per trip) to stdout for the dispatch layer to
+ * render. With `managed: false` (default) the hook exits 0 without
+ * touching anything — byte-identical pre-Phase-4 Stop behavior.
+ *
+ * `ai_team.enabled` was DELETED (road-to-always-on-orchestration Phase 1,
+ * Step 1.3) — `managed` was previously double-gated behind it, but the two
+ * keys govern independent things: `managed` governs the codex PLUGIN's own
+ * Stop-hook loop (upstream's mechanism, which does not depend on our codex
+ * CLI availability), while `/team`'s own availability is a separate,
+ * CLI-resolved fact (`src/scripts/ai_team/availability.ts`) that the
+ * conversational `/team` wrappers check, not this passive Stop hook. So the
+ * two keys are decoupled: `managed` stands alone.
+ *
+ * DELIBERATELY NOT GATED ON `emergency.orchestration_halt` (independent
+ * review, road-to-always-on-orchestration): unlike `/team`'s own
+ * conversational surfaces (`assert_delegate_allowed` / `run_team_review` in
+ * `ai_team/team_dispatch.ts`, both of which check `isOrchestrationHalted`
+ * before doing anything), this hook never reads that switch. This is
+ * intentional, not an oversight — `managed` governs the UPSTREAM codex
+ * plugin's OWN Stop-hook loop, a third-party mechanism this hook merely
+ * observes and reports on (parsing an already-persisted job record); it
+ * never itself dispatches, spends, or calls a provider. The always-on-
+ * orchestration incident switch exists to pause OUR dispatch surfaces —
+ * there is no dispatch here to pause. Tripping the halt does not, and
+ * should not, silence this hook's circuit-breaker notice about the
+ * plugin's own loop.
  *
  * Composition point (wired): registered as the `team-review-gate` concern
  * in `src/scripts/hook_manifest.yaml` on the claude `stop` slot, after
@@ -56,7 +78,7 @@ export function main(): number {
         // owns reporting it. Defaults = managed off = strict no-op.
         config = AI_TEAM_DEFAULTS;
     }
-    if (!config.enabled || !config.review_gate.managed) {
+    if (!config.review_gate.managed) {
         return 0;
     }
 

package/src/server/schemas/settings.ts

@@ -331,18 +331,9 @@ export const settingsSchema = z.object({
         }).default({}),
     }).default({}),
     subagents: z.object({
-        enabled: z.boolean().default(true).describe(
-            'Global master switch for the subagent layer. true (default) = available; false = fully disabled (the canonical kill-switch — no auto-dispatch, no routing, everything runs in-session).',
-        ),
-        auto: z.enum(['off', 'ask', 'on']).default('on').describe(
-            'Automatic-dispatch mode. off = subagents only via explicit command. ask = classify the task and ask once before dispatching. on = auto-dispatch delegable tasks (surface the choice in one line). Shipped default is on on subagent-capable hosts (flipped from ask 2026-07-09, ADR-117), off elsewhere; no-op where the host has no subagent primitive.',
-        ),
         downshift: z.boolean().default(true).describe(
             'Route delegable sub-tasks to the lowest-capable model tier (cost + speed via model downshift). false = every subagent runs on the session tier.',
         ),
-        budget_routing: z.enum(['ask', 'auto', 'off']).default('ask').describe(
-            'Budget-aware cheap-request delegation (docs/contracts/budget-routing.md): pick the cheapest classifier-adequate tier WITH available budget (cost.budgets.per_tier); cheap exhausted but strong funded → strong tier; all exhausted → session model + notice. Work is never blocked to save money; the session model is never switched (delegation with a model override). ask = confirm the first budget-motivated downshift per session (default). auto = apply silently with telemetry. off = today\'s behavior (single-flip rollback). Distinct from downshift: that is the quality/cost knob, this is the resource-availability gate.',
-        ),
         quota_arbitrage: z.boolean().default(true).describe(
             'Prefer a separate quota-pool model for delegable sub-tasks where the host manifest reports one. Optional bonus only — identical behaviour (minus the quota win) where unsupported. Never load-bearing.',
         ),
@@ -353,9 +344,6 @@ export const settingsSchema = z.object({
         }).default({}).describe(
             'Per-tier model map for downshift routing. Each empty value uses the tier runtime default (no vendor model baked in).',
         ),
-        host_capabilities: z.object({}).passthrough().default({}).describe(
-            'Optional override of the host-capability manifest (subagent_spawn / parallel_spawn / status_polling / separate_quota_pool). Any field set wins; omitted fields fall back to the all-false safe default. Empty = the agent resolves the manifest from host knowledge.',
-        ),
         implementer_model: z.string().default('').describe(
             'Override the model the orchestrator dispatches to subagents that write code (e.g. claude-sonnet-4, gpt-5). Empty (default) = inherit the session\'s primary model — cheapest and usually right.',
         ),
@@ -375,14 +363,11 @@ export const settingsSchema = z.object({
         ),
     }),
     ai_team: z.object({
-        enabled: z.boolean().default(false).describe(
-            'Master switch for the /team cross-model review family (docs/contracts/ai-team-config.md). false (default) = commands are never suggested and every invocation refuses with an enable pointer. true = the family is live; individual gates (allow_delegate) still apply.',
-        ),
         model: z.string().default('auto').describe(
             "Model handed to the codex CLI. 'auto' (default) = pass no --model flag so the CLI's own default applies — tracks the subscription's current strongest model instead of pinning a stale ID. Any other value passes through verbatim as `--model <value>`.",
         ),
         allow_delegate: z.boolean().default(false).describe(
-            'Second opt-in for the only wrapper that delegates write access (/team:delegate). false (default) = delegate refuses even when ai_team.enabled is true. Both keys must be true before delegation is reachable.',
+            'Second opt-in for the only wrapper that delegates write access (/team:delegate). false (default) = delegate refuses even when /team itself is available. Availability (codex CLI installed + authenticated) is necessary but not sufficient — this key must ALSO be true before delegation is reachable.',
         ),
         max_calls_per_day: z.number().int().min(0).default(50).describe(
             'Per-day cap on team calls, read against the EXISTING cli_call_budget openai bucket (~/.event4u/agent-config/cli-calls.json, daily UTC reset) — one subscription, one counter, never a parallel count. 0 = block all team calls.',
@@ -398,7 +383,15 @@ export const settingsSchema = z.object({
                 'Circuit-breaker bound: after this many CONSECUTIVE BLOCK verdicts in one session, a visible notice is injected exactly once and the managed layer stops re-blocking — the user decides, never an infinite Claude↔Codex loop. An ALLOW verdict resets the counter. Positive integer.',
             ),
         }).default({ managed: false, max_consecutive_blocks: 3 }),
-    }).default({ enabled: false, model: 'auto', allow_delegate: false, max_calls_per_day: 50, suppress_setup_hint: false, review_gate: { managed: false, max_consecutive_blocks: 3 } }),
+    }).default({ model: 'auto', allow_delegate: false, max_calls_per_day: 50, suppress_setup_hint: false, review_gate: { managed: false, max_consecutive_blocks: 3 } }),
+    emergency: z.object({
+        orchestration_halt: z.boolean().default(false).describe(
+            'The one audited incident switch over the always-on orchestration stack (subagents, council, team). NOT an activation gate: false (default) = the stack runs normally. true = halted; arming requires no ceremony. Disarming (returning to false) requires orchestration_halt_justification to be a non-empty string. Both transitions emit one telemetry line.',
+        ),
+        orchestration_halt_justification: z.string().default('').describe(
+            'Required non-empty before orchestration_halt may return to false. Ignored while arming the halt.',
+        ),
+    }).default({ orchestration_halt: false, orchestration_halt_justification: '' }),
     onboarding: z.object({
         onboarded: z.boolean().default(false).describe(
             'Set to true once the developer has completed `agent-config setup`. The onboarding-gate rule blocks the first turn of every chat until this is true. Toggle back to false to re-trigger the wizard.',

package/src/shared/settingsCarveOut.ts

@@ -57,16 +57,6 @@ export const SETTINGS_CARVE_OUT: readonly CarveOutKey[] = [
             'Same upgrade contract as projection.mode, and the failure is louder: '
             + 'an absent list widens the projection instead of narrowing it.',
     },
-    {
-        key: 'subagents.auto',
-        reader: 'src/scripts/routing_doctor.ts:206',
-        absentResolvesTo: 'ask',
-        reason:
-            'The reader falls back to `ask` while the template ships `on`. Carved out '
-            + 'rather than fixed at the reader because the doctor reports what the '
-            + 'RESOLVED configuration is; changing its fallback would make the report '
-            + 'disagree with what the other readers actually do.',
-    },
     {
         key: 'discipline_profile',
         reader: 'work_engine/_lib/agent_settings.ts:1263',