@event4u/agent-config 9.3.0 → 9.5.0

package/docs/anti-reskin-gate.md

@@ -0,0 +1,60 @@
+# Anti-reskin gate for your skills repo
+
+If you maintain a catalog of AI-agent skills and accept community PRs, your
+failure mode is the **find-replace re-skin**: an existing skill resubmitted
+with "Laravel" → "Symfony", "Vietnam" → "Korea", new name, same substance.
+Keyword-cosine and token-Jaccard checks miss it; manual review does not scale
+past a handful of PRs per month.
+
+This package ships the gate that catches it: `lint_originality` — an
+entity-neutralized shingle-overlap linter. Framework / vendor / region proper
+nouns are neutralized before comparing 8-word shingles, so the swap does not
+move the score: a re-skin scores ~100 % overlap while the worst legitimate
+pair in a 496-artifact corpus scores 40 %. Class templates and
+document-frequency boilerplate are subtracted, so shared scaffolding never
+scores. The `--changed` mode is batch-masking-hardened: a batch of
+near-identical submissions cannot classify its own shared shingles as
+boilerplate (regression-locked in `tests/scripts/lint_originality.test.ts`).
+
+It runs as a blocking PR gate on this repo (`originality-gate` job in
+[`.github/workflows/skill-lint.yml`](../.github/workflows/skill-lint.yml)).
+
+## Run it on your own catalog — today
+
+The tool is not yet a standalone package; it runs from a clone. The corpus
+roots are fixed (`src/skills/*/SKILL.md`), so you stage your skills into one:
+
+```bash
+git clone --depth 1 https://github.com/event4u-app/agent-config
+cd agent-config && npm ci
+
+# Stage your catalog into the skills corpus root (one dir per skill):
+for f in /path/to/your-repo/skills/*/SKILL.md; do
+  d="src/skills/ext-$(basename "$(dirname "$f")")"
+  mkdir -p "$d" && cp "$f" "$d/SKILL.md"
+done
+
+# Compare your skills against each other (and this corpus) in one pass:
+./scripts-run src/scripts/lint_originality --changed src/skills/ext-*/SKILL.md
+```
+
+Exit `1` with an offending pair + overlap % means a re-skin; exit `0` means no
+same-class pair exceeds the 40 % warn floor. Thresholds are env-overridable
+(`ORIGINALITY_FAIL`, `ORIGINALITY_WARN`).
+
+## Want this as a zero-config `npx` tool?
+
+We will extract `lint_originality` as a standalone zero-config package
+(`--changed` mode for PR CI, no repo coupling, regression suite included) **if
+there is real demand** — the bet is settled by a measured floor, not opinion:
+
+- **Signal:** open an issue on this repo titled `anti-reskin gate: standalone
+  request` (or reference `lint_originality` in an issue/PR about your own
+  catalog).
+- **Floor:** ≥ 3 distinct external maintainers signal within 90 days of this
+  page landing on `main` → we ship the extraction.
+- **Kill criterion:** floor missed → extraction is cancelled and recorded;
+  this page stays as the run-from-clone recipe.
+
+Contract: [`docs/contracts/adoption-signal-floor.md` § Extraction demand
+gate](contracts/adoption-signal-floor.md#extraction-demand-gate--lint_originality-standalone-probe).

package/docs/architecture.md

@@ -146,9 +146,9 @@ note, package-internal path-swap, description budget, and the
 
 | Layer | Count | Purpose |
 |---|---|---|
-| **Skills** | 276 | On-demand expertise — stack analysis (Laravel · Symfony · Zend / Laminas · Next.js · React · Node), testing, Docker, API design, security, observability, … |
+| **Skills** | 278 | On-demand expertise — stack analysis (Laravel · Symfony · Zend / Laminas · Next.js · React · Node), testing, Docker, API design, security, observability, … |
 | **Rules** | 105 | Always-active constraints — coding standards, scope control, verification, language-and-tone, agent-authority |
-| **Commands** | 189 | Slash-command workflows — `/commit`, `/create-pr`, `/fix ci`, `/optimize skills`, `/feature plan`, `/work`, `/implement-ticket`, `/condense`, … |
+| **Commands** | 190 | Slash-command workflows — `/commit`, `/create-pr`, `/fix ci`, `/optimize skills`, `/feature plan`, `/work`, `/implement-ticket`, `/condense`, … |
 | **Guidelines** | 101 | Reference material cited by skills — PHP patterns, Eloquent, Playwright, agent-infra, … |
 | **Templates** | 7 | Scaffolds for features, roadmaps, contexts, skills, overrides |
 | **Contexts** | 5 | Shared knowledge about the system itself |

package/docs/benchmark.md

@@ -582,3 +582,43 @@ controversial-but-correct control.
   judge-survivable-subtlety corpus with a published distribution, then (2) a
   maintainer-gated paid cross-vendor run. Honest-null on that run keeps the
   surface default-off permanently, like recursive-verification.
+
+
+## Defect-finding: team vs self-review vs council (2026-07-20) — HONEST NULL (ceiling-limited) {#honest-null-defect}
+
+Pre-registered 12-fixture corpus (`internal/bench/corpora/defect-finding.yaml`:
+10 seeded-defect diffs across logic / off-by-one / race / missing-empty-state /
+security-smell, + 2 controls), three arms, deterministic file-level recall
+against ground truth (blind rubric judge deferred — the primary metric is
+deterministic). Codex reviewer pinned `gpt-5.5`. Total billable $0.083 (arm b
+codex = ChatGPT subscription, $0).
+
+| arm | recall | correctness | design | false-positives |
+|---|--:|--:|--:|--:|
+| self-review (single model) | 1.00 | 1.00 | 1.00 | 1 |
+| team (cross-model, codex) | 1.00 | 1.00 | 1.00 | 0 |
+| council (neutral breadth)  | 1.00 | 1.00 | 1.00 | 0 |
+
+**Verdict: HONEST NULL.** H1 (cross-model team > single-model self-review on
+correctness recall, Δ ≥ +0.20) is **not met** — Δ = 0: all three arms recalled
+every planted defect. H2 (council ≈ team on design, within 0.10) is met (Δ = 0).
+H3 (≤ 1 false positive/arm) is met.
+
+**Corpus-validity caveat (the honest bound):** recall 1.00 across every arm is a
+**ceiling effect** — these seeded defects are catchable by any strong model, so
+the corpus cannot discriminate the arms on recall. This is the same limitation
+the adversarial-verification-council section names: a corpus of obvious,
+model-differentiating defects measures parity, not the judge-survivable
+subtleties where a cross-model lens might actually differ. The one non-null
+signal is precision, not recall: single-model self-review produced 1 false
+positive on the controversial-but-correct control (`df-ctl-01`, a
+behaviour-preserving `clamp` refactor) where team and council produced 0 — a
+hint of a multi-arm precision edge, within the pre-registered H3 bound, too
+small to claim.
+
+**Disposition (Phase 5 Step 5): evidence-closed as NULL.** No cross-model
+defect-finding *quality/lift* claim binds; team mode stays documented as
+**workflow value only**. Re-open conditions: (a) a curated
+judge-survivable-subtlety corpus that breaks the recall ceiling, or (b) a new
+model generation. The worker-via-bundle delegate (roadmap Phase 3 Step 4) stays
+deferred — it re-opened only on a measured review lift, which did not occur.