@event4u/agent-config 9.28.0 → 9.29.0

package/src/scripts/rebuild_hook_bundle.ts

@@ -0,0 +1,177 @@
+#!/usr/bin/env tsx
+/**
+ * Safe self-heal for the self-hosted hook bundle — the builder that
+ * `check_hook_bundle_freshness` deliberately is not.
+ *
+ * WHY THIS EXISTS — measured, not hypothetical.
+ *
+ * The freshness gate reds after ANY hook-source merge from main, because
+ * `dist/hooks/dispatch.js` is untracked and nothing in the local chain
+ * rebuilds it. On 2026-08-09 that turned `task release` (9.28.0) into a
+ * blocked push with a remedy the operator had to run by hand — a routine
+ * pre-push chore promoted to a release incident. The gate is right to never
+ * build (its documented hazard: esbuild overwriting the dispatcher a running
+ * hook is executing can wedge the tool loop). The hazard is in HOW a naive
+ * rebuild writes, not in rebuilding: this script builds to a sibling `.new`
+ * file, proves the result actually dispatches, and only then renames it into
+ * place — an atomic same-directory rename that a running hook holding an open
+ * file descriptor never observes mid-write.
+ *
+ * The `.new` file MUST live in `dist/hooks/` (not a temp dir): the bundle
+ * resolves `src/scripts/hook_manifest.yaml` relative to its OWN location via
+ * the `__AGENT_CONFIG_BUNDLE__` path-depth switch. Built anywhere else, every
+ * probe answers "manifest missing" with exit 0 and the smoke test proves
+ * nothing (measured 2026-08-08).
+ *
+ * The esbuild invocation is NOT duplicated here — it is read from
+ * `package.json`'s `build:hooks` script and only the `--outfile=` is
+ * rewritten, so the flag set (banner, defines, target) has exactly one home.
+ *
+ * Behaviour:
+ *   no self-hosted bundle → no-op (fresh checkout / CI — nothing is running
+ *                           stale code, and materialising a bundle here would
+ *                           change what other gates see)
+ *   bundle fresh          → no-op
+ *   bundle stale          → rebuild to `.new`, probe, rename into place
+ *   build or probe fails  → the `.new` file is removed and the OLD bundle
+ *                           keeps running (old-but-working beats broken);
+ *                           exit 1 so the freshness gate behind this still
+ *                           reds and the failure is loud.
+ *
+ * Exit codes: 0 = fresh / healed / nothing to heal · 1 = heal failed.
+ */
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { check } from "./check_hook_bundle_freshness.js";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(HERE, "..", "..");
+const LIVE_REL = path.join("dist", "hooks", "dispatch.js");
+const NEW_REL = path.join("dist", "hooks", "dispatch.new.js");
+
+/**
+ * Rewrite the `--outfile=` of the canonical `build:hooks` script to the
+ * `.new` sibling. Returns null when the expected outfile token is absent —
+ * a changed `package.json` must fail loudly, never build to a guessed path.
+ */
+export function rewriteOutfile(script: string, newOutfile: string): string | null {
+  const token = `--outfile=${LIVE_REL}`;
+  if (!script.includes(token)) return null;
+  return script.replace(token, `--outfile=${newOutfile}`);
+}
+
+/**
+ * Verdict on a dispatcher probe. The probe contract is pinned against the
+ * real dry-run output: exit 0 AND parseable JSON AND a non-empty `concerns`
+ * array. Exit 0 alone is NOT enough — a bundle that cannot find its manifest
+ * answers "manifest missing" with exit 0 (measured 2026-08-08), which is
+ * exactly the broken dispatcher this probe exists to keep out of the live
+ * path. Returns null on pass, a human-readable reason on failure.
+ */
+export function probeVerdict(exitCode: number, stdout: string): string | null {
+  if (exitCode !== 0) return `probe exited ${String(exitCode)}`;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return `probe output is not JSON: ${stdout.slice(0, 120)}`;
+  }
+  const concerns = (parsed as { concerns?: unknown }).concerns;
+  if (!Array.isArray(concerns) || concerns.length === 0) {
+    return "probe JSON carries no concerns — the bundle dispatched nothing";
+  }
+  return null;
+}
+
+function cleanup(newAbs: string): void {
+  try {
+    fs.rmSync(newAbs, { force: true });
+  } catch {
+    // Best-effort: a leftover .new file is inert (nothing executes it).
+  }
+}
+
+export function main(): number {
+  const r = check(REPO_ROOT);
+
+  if (r.skipped) {
+    process.stdout.write(
+      `✅  OK  rebuild_hook_bundle: no self-hosted ${LIVE_REL} — nothing runs stale code, nothing to heal\n`,
+    );
+    return 0;
+  }
+  if (r.stale.length === 0) {
+    process.stdout.write("✅  OK  rebuild_hook_bundle: bundle already fresh — no rebuild needed\n");
+    return 0;
+  }
+
+  process.stdout.write(
+    `🔧  hook bundle stale (${String(r.stale.length)} newer source(s)) — rebuilding safely (build .new → probe → atomic rename)\n`,
+  );
+
+  const pkg = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, "package.json"), "utf-8")) as {
+    scripts?: Record<string, string>;
+  };
+  const buildScript = pkg.scripts?.["build:hooks"];
+  if (buildScript === undefined) {
+    console.error("❌  rebuild_hook_bundle: package.json has no build:hooks script");
+    return 1;
+  }
+  const cmd = rewriteOutfile(buildScript, NEW_REL);
+  if (cmd === null) {
+    console.error(
+      `❌  rebuild_hook_bundle: build:hooks no longer targets --outfile=${LIVE_REL} — ` +
+        "refusing to build to a guessed path; update this script alongside package.json",
+    );
+    return 1;
+  }
+
+  const newAbs = path.join(REPO_ROOT, NEW_REL);
+  const build = spawnSync("sh", ["-c", cmd], {
+    cwd: REPO_ROOT,
+    encoding: "utf-8",
+    env: { ...process.env, PATH: `${path.join(REPO_ROOT, "node_modules", ".bin")}:${process.env["PATH"] ?? ""}` },
+  });
+  if (build.status !== 0) {
+    cleanup(newAbs);
+    console.error(`❌  rebuild_hook_bundle: esbuild failed (${String(build.status)}):`);
+    console.error((build.stderr || build.stdout || "").trim());
+    return 1;
+  }
+
+  const probe = spawnSync(
+    "node",
+    [newAbs, "--platform", "claude", "--event", "pre_tool_use", "--dry-run"],
+    { cwd: REPO_ROOT, encoding: "utf-8", input: "{}" },
+  );
+  const verdict = probeVerdict(probe.status ?? 1, probe.stdout ?? "");
+  if (verdict !== null) {
+    cleanup(newAbs);
+    console.error(`❌  rebuild_hook_bundle: new bundle failed its probe — ${verdict}`);
+    console.error("    The old bundle stays in place (old-but-working beats broken).");
+    return 1;
+  }
+
+  fs.renameSync(newAbs, path.join(REPO_ROOT, LIVE_REL));
+  process.stdout.write(
+    `✅  OK  rebuild_hook_bundle: rebuilt + probed + renamed into place (${String(r.checked)} bundled source(s))\n`,
+  );
+  return 0;
+}
+
+const invokedDirectly = ((): boolean => {
+  const entry = process.argv[1];
+  if (entry === undefined) return false;
+  try {
+    return fs.realpathSync(path.resolve(entry)) === fs.realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+})();
+
+if (invokedDirectly) {
+  process.exit(main());
+}

package/src/scripts/release.ts

@@ -1073,6 +1073,78 @@ function _tag_exists_remote(tag: string): boolean {
     return r.returncode === 0;
 }
 
+/**
+ * True when git rejected a tag push because the ref already exists on the
+ * remote. Wording pinned from the real failure (2026-08-09, 9.28.0 — two
+ * concurrent resume runs, the loser crashed):
+ *
+ *     ! [remote rejected]  9.28.0 -> 9.28.0 (cannot lock ref 'refs/tags/9.28.0': reference already exists)
+ *
+ * plus the `[rejected] … (already exists)` variant git emits when the local
+ * and remote tag objects differ.
+ */
+export function _is_tag_already_exists(stderr: string, stdout: string): boolean {
+    const text = `${stderr}\n${stdout}`;
+    return /\[(?:remote )?rejected\]/i.test(text) && /already exists/i.test(text);
+}
+
+/** Peeled commit the remote tag points at, or null when the tag is absent. */
+function _remote_tag_commit(tag: string): string | null {
+    const r = run(['git', 'ls-remote', REMOTE, `refs/tags/${tag}`, `refs/tags/${tag}^{}`], {
+        check: false,
+        capture: true,
+    });
+    if (r.returncode !== 0) return null;
+    const lines = r.stdout.trim().split('\n').filter(Boolean);
+    if (lines.length === 0) return null;
+    // An annotated tag lists the tag object AND the peeled `^{}` commit — the
+    // peeled line wins so the comparison is commit-vs-commit regardless of
+    // whether the two runs minted distinct tag objects for the same commit.
+    const peeled = lines.find((l) => l.trimEnd().endsWith('^{}'));
+    return (peeled ?? (lines[0] as string)).split('\t')[0] ?? null;
+}
+
+/**
+ * Push a tag, tolerating exactly ONE failure: the concurrent-release race.
+ * `_tag_exists_remote` in step 8 is a live check, but between it and this
+ * push a parallel `task release` run can land the same tag (measured
+ * 2026-08-09, 9.28.0). When the remote tag already points at the same commit
+ * as the local one, the repository IS in the desired state — continue. Any
+ * other rejection, and a same-name tag on a DIFFERENT commit, stays fatal
+ * with the push output as the error.
+ */
+function _push_tag(tag: string): void {
+    const first = run(['git', 'push', REMOTE, tag], { check: false, capture: true });
+    if (first.returncode === 0) {
+        process.stdout.write(first.stdout);
+        process.stderr.write(first.stderr);
+        return;
+    }
+    if (_is_tag_already_exists(first.stderr, first.stdout)) {
+        const remote = _remote_tag_commit(tag);
+        const local = git(['rev-list', '-n', '1', tag], { capture: true });
+        if (remote !== null && remote === local) {
+            process.stdout.write(
+                `↻  tag ${tag} already on ${REMOTE} at the same commit — a parallel run pushed it; continuing\n`,
+            );
+            return;
+        }
+        process.stdout.write(first.stdout);
+        process.stderr.write(first.stderr);
+        die(
+            `tag ${tag} exists on ${REMOTE} pointing at ${remote ?? '<unreadable>'} while the local tag ` +
+                `points at ${local} — refusing to overwrite a published tag; ` +
+                'delete the wrong one deliberately and re-run',
+        );
+    }
+    process.stdout.write(first.stdout);
+    process.stderr.write(first.stderr);
+    die(
+        `push of tag ${tag} failed (exit ${first.returncode}) — ` +
+            'the push output above is the real error (a pre-push gate, credentials, or protection)',
+    );
+}
+
 /** Most recent PR (any state) with `release/X.Y.Z` as head, or null. */
 function _pr_for_branch(branch: string): Record<string, unknown> | null {
     const r = run(
@@ -2029,7 +2101,7 @@ function execute(
             _step(8, total, `Tag ${plan.target} already on ${REMOTE} — skip`);
         } else {
             _step(8, total, `Tag ${plan.target} exists locally — push only`);
-            run(['git', 'push', REMOTE, plan.target]);
+            _push_tag(plan.target);
         }
     } else {
         // Sequencing is load-bearing (release-truth Phase 1, council
@@ -2047,7 +2119,7 @@ function execute(
             );
         }
         run(['git', 'tag', '-a', plan.target, '-m', tag_message_from_section(merged!.body, plan.target)]);
-        run(['git', 'push', REMOTE, plan.target]);
+        _push_tag(plan.target);
     }
 
     // ─── 9. GitHub Release ──────────────────────────────────────────────────

package/src/scripts/routing_doctor.ts

@@ -53,7 +53,7 @@ import {
 import * as hooks_status from "./hooks_status.js";
 import { load_agent_settings } from "./_lib/agent_settings.js";
 import {
-  resolveHostCapabilities,
+  probeHostCapabilities,
   type HostCapabilityManifest,
 } from "./_lib/host_capability.js";
 import {
@@ -99,10 +99,9 @@ export interface FreshnessReport {
 }
 
 export interface OrchestrationReport {
-  enabled: boolean;
-  auto: string;
+  /** `emergency.orchestration_halt` — the one audited incident switch. */
+  halted: boolean;
   downshift: boolean;
-  budget_routing: string;
   /** cost.budgets.per_tier ceilings + live cool-down state per tier. */
   tier_budgets: Record<string, { ceiling_usd: number | null; cooldown_until_ms: number }>;
   host_manifest: HostCapabilityManifest;
@@ -141,22 +140,19 @@ export interface OrchestrationReport {
 }
 
 /**
- * Adherence ≠ delivery: budget routing binds via policy prose, so the
- * doctor checks the DELIVERY evidence — orchestration audit lines that
- * carry a tier decision. Eligible dispatches recorded while
- * `budget_routing != off` but ZERO tier-carrying lines → WARN with the
- * exact reason. Read-only over agents/runtime/state/audit/*.jsonl; no
- * new state. This closes the same blind-spot class the session-canary
- * incident exposed (policy present, delivery silently absent).
+ * Adherence ≠ delivery: budget-aware tier routing has no on/off setting any
+ * more (always-on orchestration removed `subagents.budget_routing`), so the
+ * doctor always checks the DELIVERY evidence — orchestration audit lines
+ * that carry a tier decision. Dispatches recorded with ZERO tier-carrying
+ * lines → WARN with the exact reason. Read-only over
+ * agents/runtime/state/audit/*.jsonl; no new state. This closes the same
+ * blind-spot class the session-canary incident exposed (policy present,
+ * delivery silently absent).
  */
 export function check_budget_delivery(
   workspace_root: string,
-  budget_routing: string,
 ): OrchestrationReport["delivery"] {
   const out = { eligible_dispatches: 0, budget_evidence_lines: 0, warning: "" };
-  if (budget_routing === "off") {
-    return out;
-  }
   const auditDir = path.join(workspace_root, "agents", "runtime", "state", "audit");
   let files: string[] = [];
   try {
@@ -188,7 +184,7 @@ export function check_budget_delivery(
   }
   if (out.eligible_dispatches > 0 && out.budget_evidence_lines === 0) {
     out.warning =
-      `budget_routing=${budget_routing} is policy-bound but shows no delivery evidence: ` +
+      `budget-aware tier routing shows no delivery evidence: ` +
       `${out.eligible_dispatches} orchestration dispatch(es) recorded, 0 carry a tier decision — ` +
       `the relation may not be running (adherence != delivery)`;
   }
@@ -237,17 +233,16 @@ export function collect_orchestration(
 ): OrchestrationReport {
   const settings = load_agent_settings({ cwd: workspace_root });
   const sub = (settings["subagents"] ?? {}) as Record<string, unknown>;
-  const enabled = sub["enabled"] !== false;
-  const auto = typeof sub["auto"] === "string" ? (sub["auto"] as string) : "ask";
+  const emergency = (settings["emergency"] ?? {}) as Record<string, unknown>;
+  const halted = emergency["orchestration_halt"] === true;
   const downshift = sub["downshift"] !== false;
-  const host_manifest = resolveHostCapabilities(platform, sub["host_capabilities"]);
+  const host_manifest = probeHostCapabilities(platform);
   const activationInputs: ActivationInputs = {
-    enabled,
-    auto: (auto === "on" || auto === "off" ? auto : "ask") as ActivationInputs["auto"],
+    halted,
     subagent_spawn: host_manifest.subagent_spawn,
   };
   // Canonical delegable probe: the gate verdict shows which activation
-  // layer (settings / host primitive) decides on THIS installation.
+  // layer (emergency halt / host primitive) decides on THIS installation.
   const probe = classifyTask(
     { size_estimate: 5, independent_slices: 3 },
     activationInputs,
@@ -256,14 +251,6 @@ export function collect_orchestration(
   const cost_budgets = (cost["budgets"] ?? {}) as Record<string, unknown>;
   const tracking_dir = path.join(workspace_root, "agents", "cost-tracking");
   const ledger_present = fs.existsSync(path.join(tracking_dir, "sessions.jsonl"));
-  // YAML 1.1 trap: an unquoted `off` parses as boolean false — coerce it
-  // back to the enum string so the check honors the user's intent.
-  const budget_routing =
-    sub["budget_routing"] === false
-      ? "off"
-      : typeof sub["budget_routing"] === "string"
-        ? (sub["budget_routing"] as string)
-        : "ask";
   const per_tier = (cost_budgets["per_tier"] ?? {}) as Record<string, unknown>;
   const cooldowns = readCooldowns(tracking_dir);
   const tier_budgets: OrchestrationReport["tier_budgets"] = {};
@@ -289,10 +276,8 @@ export function collect_orchestration(
     };
   }
   return {
-    enabled,
-    auto,
+    halted,
     downshift,
-    budget_routing,
     tier_budgets,
     host_manifest,
     host_platform: platform,
@@ -301,7 +286,7 @@ export function collect_orchestration(
     cost_budgets,
     ledger_present,
     sample,
-    delivery: check_budget_delivery(workspace_root, budget_routing),
+    delivery: check_budget_delivery(workspace_root),
   };
 }
 
@@ -516,8 +501,8 @@ function _render(report: DoctorReport): string {
   lines.push("");
   const o = report.orchestration;
   lines.push(
-    `Orchestration: enabled=${o.enabled} · auto=${o.auto} · downshift=${o.downshift} · ` +
-      `budget_routing=${o.budget_routing} · subagent_spawn=${o.host_manifest.subagent_spawn} ` +
+    `Orchestration: halted=${o.halted} · downshift=${o.downshift} · ` +
+      `subagent_spawn=${o.host_manifest.subagent_spawn} ` +
       `(host=${o.host_platform}${o.host_platform_assumed ? ", ASSUMED" : ", observed"}) · ` +
       `ledger=${o.ledger_present ? "present" : "absent"}`,
   );

package/src/scripts/score_skill_selection.ts

@@ -19,10 +19,22 @@
  *     pass = (a) >= 0.90  OR  (b) >= 0.95
  *     fail = (a) <  0.80  AND  (b) <  0.80   →  cluster needs `routes_to`
  *
- * NOTE: the .py reads the legacy `.agent-src.uncondensed/skills` literal;
- * this faithful twin replicates it byte-for-byte. When inputs are missing
- * the .py raises an uncaught FileNotFoundError → exit 1; this twin mirrors
- * that by throwing.
+ * REPOINTED 2026-08-09 (P2.2 of road-to-rule-delivery-integrity). The original
+ * read the uncondensed legacy skills tree, faithfully replicating a `.py` twin —
+ * but ADR-051 retired that tree as dead and it does not exist in this checkout.
+ * A scorer pointed at a missing directory does not fail: its glob yields
+ * nothing, every fixture scores against an empty skill set, and the output is a
+ * baseline of silent zeros. That is worse than an error, because a baseline is
+ * exactly what P2.2's pre-registered criteria compare against — the measurement
+ * would have been void and would have looked fine.
+ *
+ * Now reads `SRC_SKILLS()` from the shared resolver. `dist/agent-src/skills`
+ * would be equally valid (ADR-201 makes the projection a byte-exact copy, so
+ * the frontmatter is identical); `src/` is chosen because it is the source of
+ * truth and is present even before a sync.
+ *
+ * When inputs are missing the original raised an uncaught FileNotFoundError →
+ * exit 1; this twin mirrors that by throwing.
  */
 
 import * as fs from 'node:fs';
@@ -30,12 +42,14 @@ import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { parse as parseYaml } from 'yaml';
 
+import { SRC_SKILLS } from './_lib/agent_src.js';
+
 const _HERE = fileURLToPath(import.meta.url);
 // src/scripts/score_skill_selection.ts → parents[2] is the repo root.
 const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
 const FIXTURES = path.join(REPO_ROOT, 'tests', 'fixtures', 'skill_selection', 'fixtures.yml');
 const CLUSTERS = path.join(REPO_ROOT, 'agents', 'reports', 'skill-collision-clusters.json');
-const SKILLS_DIR = path.join(REPO_ROOT, '.agent-src.uncondensed', 'skills');
+const SKILLS_DIR = SRC_SKILLS();
 const DEFAULT_OUT = path.join(REPO_ROOT, 'agents', 'reports', 'skill-selection-accuracy.json');
 
 const PASS_A = 0.9;