@event4u/agent-config 9.31.0 → 9.33.0

package/src/agent-src/templates/scripts/work_engine/directives/backend/test.ts

@@ -17,10 +17,12 @@
  * - Must be a dict.
  * - Must carry a `verdict` key — one of `success`, `failed`,
  *   or `mixed` (targeted vs full-suite split). Anything else blocks.
- * - `failed` or `mixed` verdicts halt with the verdict as part of
- *   the surfaced message so the user decides whether to continue or
- *   stop. This follows the `verify-before-complete` rule: a bad test
- *   outcome must never be silently skipped.
+ * - `failed` or `mixed` verdicts enter the bounded self-fix loop
+ *   (`./_self_fix.ts`): the first attempts are delegated by directive, and an
+ *   exhausted or non-progressing loop exits `PARTIAL` with the verdict still
+ *   on the surface so the user decides whether to continue or stop. This
+ *   follows the `verify-before-complete` rule: a bad test outcome must never
+ *   be silently skipped, and the loop cannot report one as success.
  * - Optional keys (`targeted`, `full`, `duration_ms`,
  *   `followups`) feed the delivery report.
  */
@@ -28,6 +30,7 @@
 import type { DeliveryState} from '../../delivery_state.js';
 import { type Any, Outcome, StepResult, agent_directive } from '../../delivery_state.js';
 import { resolve_policy } from '../../persona_policy.js';
+import { decide, partial_exit, record_attempt, retry_halt, unmet_dod, verdict_signature } from './_self_fix.js';
 
 const _ALLOWED_VERDICTS = ['success', 'failed', 'mixed'] as const;
 
@@ -53,7 +56,18 @@ export const AMBIGUITIES: ReadonlyArray<Record<string, string>> = [
     {
         code: 'bad_test_verdict',
         trigger: '`state.tests[\'verdict\']` is `failed` or `mixed`',
-        resolution: 'fix failures and re-run, or abort',
+        resolution:
+            'bounded self-fix loop: agent directive `fix-failing-checks` ' +
+            'while attempts remain and the verdict signature keeps changing',
+    },
+    {
+        code: 'self_fix_exhausted',
+        trigger:
+            'the self-fix budget for `test` is spent, or two consecutive ' +
+            'attempts produced an identical verdict signature',
+        resolution:
+            'PARTIAL honest exit — the red verdict stays on the surface, ' +
+            'the user decides whether to take over, override, or abort',
     },
 ];
 
@@ -156,18 +170,39 @@ function _blocked_on_shape(state: DeliveryState, issues: string[]): StepResult {
     });
 }
 
+/**
+ * Route a red test verdict through the bounded self-fix loop.
+ *
+ * Before this loop existed the function below returned a directive-free
+ * BLOCKED — a user question block — so every red cost a user round-trip even
+ * when the failure was one the agent could fix unaided. Now the first attempts
+ * are delegated and only an exhausted or non-progressing loop reaches the
+ * user, as a PARTIAL that still carries the red verdict.
+ */
 function _blocked_on_bad_verdict(state: DeliveryState, verdict: Any): StepResult {
     const ticketId = _ticketId(state);
-    return new StepResult({
-        outcome: Outcome.BLOCKED,
-        questions: [
-            `> Ticket ${ticketId} — tests reported \`${String(verdict)}\`. ` +
-                'Verification cannot proceed on a non-success verdict.',
-            '> 1. Fix the failing tests and re-run `run-tests`',
-            '> 2. Continue anyway — override (NOT recommended)',
-            '> 3. Abort',
-        ],
-        message: `Ticket ${ticketId} test verdict was \`${String(verdict)}\`, not success.`,
+    const signature = verdict_signature('test', state.tests);
+    const decision = decide(state, 'test', signature);
+
+    if (decision.kind === 'retry') {
+        record_attempt(state, 'test', signature);
+        return retry_halt({
+            lane: 'test',
+            ticket_id: ticketId,
+            verdict,
+            decision,
+            fix_hint: 'read the failing assertions, fix the cause, re-run the same filter.',
+            rerun_directive: 'run-tests',
+        });
+    }
+
+    return partial_exit({
+        lane: 'test',
+        ticket_id: ticketId,
+        verdict,
+        decision,
+        unmet: unmet_dod(state),
+        rerun_directive: 'run-tests',
     });
 }
 

package/src/agent-src/templates/scripts/work_engine/directives/backend/verify.ts

@@ -18,9 +18,12 @@
  *   `partial`. Matches the `Outcome` vocabulary used everywhere
  *   else in the flow.
  * - A `success` verdict advances the flow to `report`.
- * - A `blocked` or `partial` verdict halts with numbered options
- *   so the user decides whether to address the findings, override
- *   (rarely appropriate), or abort.
+ * - A `blocked` or `partial` verdict enters the bounded self-fix loop
+ *   (`./_self_fix.ts`): while attempts remain and the verdict signature
+ *   keeps changing, the fix is delegated by directive. An exhausted or
+ *   non-progressing loop exits `PARTIAL` with numbered options so the user
+ *   decides whether to take over, override (rarely appropriate), or abort.
+ *   The loop never turns a non-success verdict into `SUCCESS`.
  * - Optional keys (`confidence`, `findings`, `followups`) feed
  *   the delivery report.
  */
@@ -28,6 +31,7 @@
 import type { DeliveryState} from '../../delivery_state.js';
 import { type Any, Outcome, StepResult, agent_directive } from '../../delivery_state.js';
 import { resolve_policy } from '../../persona_policy.js';
+import { decide, partial_exit, record_attempt, retry_halt, unmet_dod, verdict_signature } from './_self_fix.js';
 
 const _ALLOWED_VERDICTS = ['success', 'blocked', 'partial'] as const;
 
@@ -52,7 +56,17 @@ export const AMBIGUITIES: ReadonlyArray<Record<string, string>> = [
         code: 'bad_verify_verdict',
         trigger: '`state.verify[\'verdict\']` is `blocked` or `partial`',
         resolution:
-            'address findings and re-run `/review-changes` — never bypass ' + '(see `verify-before-complete`)',
+            'bounded self-fix loop: agent directive `fix-failing-checks` ' +
+            'while attempts remain — never bypass ' + '(see `verify-before-complete`)',
+    },
+    {
+        code: 'self_fix_exhausted',
+        trigger:
+            'the self-fix budget for `verify` is spent, or two consecutive ' +
+            'attempts produced an identical verdict signature',
+        resolution:
+            'PARTIAL honest exit — the non-success verdict stays on the ' +
+            'surface; the user takes over, overrides, or aborts',
     },
 ];
 
@@ -145,19 +159,39 @@ function _blocked_on_shape(state: DeliveryState, issues: string[]): StepResult {
     });
 }
 
+/**
+ * Route a red review verdict through the bounded self-fix loop.
+ *
+ * Same shape as the `test` lane, separate counter: `autonomous-execution`
+ * resets its N=3 budget on a different validation target, and a review finding
+ * is not a failing test. `verify-before-complete` is unaffected — the loop
+ * cannot report completion, and its exhausted exit is PARTIAL with the
+ * non-success verdict still on the surface.
+ */
 function _blocked_on_bad_verdict(state: DeliveryState, verdict: Any): StepResult {
     const ticketId = _ticketId(state);
-    return new StepResult({
-        outcome: Outcome.BLOCKED,
-        questions: [
-            `> Ticket ${ticketId} — \`review-changes\` reported ` +
-                `\`${String(verdict)}\`. The delivery report cannot claim completion on a ` +
-                'non-success verdict (see `verify-before-complete`).',
-            '> 1. Address the findings and re-run `review-changes`',
-            '> 2. Continue anyway — override (NOT recommended)',
-            '> 3. Abort',
-        ],
-        message: `Ticket ${ticketId} verify verdict was \`${String(verdict)}\`, not success.`,
+    const signature = verdict_signature('verify', state.verify);
+    const decision = decide(state, 'verify', signature);
+
+    if (decision.kind === 'retry') {
+        record_attempt(state, 'verify', signature);
+        return retry_halt({
+            lane: 'verify',
+            ticket_id: ticketId,
+            verdict,
+            decision,
+            fix_hint: 'address the recorded findings, then re-run the four-judge review.',
+            rerun_directive: 'review-changes',
+        });
+    }
+
+    return partial_exit({
+        lane: 'verify',
+        ticket_id: ticketId,
+        verdict,
+        decision,
+        unmet: unmet_dod(state),
+        rerun_directive: 'review-changes',
     });
 }
 

package/src/agent-src/templates/scripts/work_engine/state.ts

@@ -220,6 +220,7 @@ export class WorkState {
     ui_polish: Dict | null;
     contract: Dict | null;
     stitch: Dict | null;
+    self_fix: Dict | null;
     halts: Dict[];
     version: number;
     persona: string;
@@ -245,6 +246,7 @@ export class WorkState {
         ui_polish?: Dict | null;
         contract?: Dict | null;
         stitch?: Dict | null;
+        self_fix?: Dict | null;
         halts?: Dict[];
         version?: number;
         persona?: string;
@@ -269,6 +271,7 @@ export class WorkState {
         this.ui_polish = opts.ui_polish ?? null;
         this.contract = opts.contract ?? null;
         this.stitch = opts.stitch ?? null;
+        this.self_fix = opts.self_fix ?? null;
         this.halts = opts.halts ?? [];
         this.version = opts.version ?? SCHEMA_VERSION;
         this.persona = opts.persona ?? 'senior-engineer';
@@ -309,6 +312,7 @@ export function to_dict(state: WorkState): Dict {
     _validate_ui_polish(state.ui_polish);
     _validate_contract(state.contract);
     _validate_stitch(state.stitch);
+    _validate_self_fix(state.self_fix);
     _validate_halts(state.halts);
     return {
         version: state.version,
@@ -324,6 +328,7 @@ export function to_dict(state: WorkState): Dict {
         ui_polish: state.ui_polish,
         contract: state.contract,
         stitch: state.stitch,
+        self_fix: state.self_fix,
         halts: [...state.halts],
         persona: state.persona,
         memory: state.memory,
@@ -406,6 +411,9 @@ export function from_dict(payload: JsonValue): WorkState {
     const stitch = payload['stitch'] ?? null;
     _validate_stitch(stitch);
 
+    const self_fix = payload['self_fix'] ?? null;
+    _validate_self_fix(self_fix);
+
     const halts = 'halts' in payload ? payload['halts'] : [];
     _validate_halts(halts);
 
@@ -422,6 +430,7 @@ export function from_dict(payload: JsonValue): WorkState {
         ui_polish: _isDict(ui_polish) ? { ...ui_polish } : null,
         contract: _isDict(contract) ? { ...contract } : null,
         stitch: _isDict(stitch) ? { ...stitch } : null,
+        self_fix: _isDict(self_fix) ? { ...self_fix } : null,
         halts: Array.isArray(halts) ? ([...halts] as Dict[]) : [],
         version: version as number,
         persona: _get(payload, 'persona', 'senior-engineer') as string,
@@ -866,6 +875,71 @@ function _validate_ui_review(ui_review: JsonValue): void {
     }
 }
 
+/**
+ * Reject malformed `self_fix` envelopes; tolerate `null` and `{}`.
+ *
+ * `null` means no red check has been seen. Once populated, each key is a lane
+ * name (`test`, `verify`) whose record may carry `attempts` (a non-negative
+ * int) and `signatures` (a list of strings). As with `ui_polish`, the schema
+ * enforces only shape: the ceiling and the no-progress floor are the handler's
+ * business (`directives/backend/_self_fix.ts`), so a state file cannot decide
+ * how many attempts are allowed.
+ *
+ * `attempts` is validated but NOT bounded here on purpose. A file carrying
+ * `attempts: 99` is well-formed and simply exhausted — rejecting it would turn
+ * a spent budget into a crash, and the loop's whole point is a clean exit.
+ */
+function _validate_self_fix(self_fix: JsonValue): void {
+    if (self_fix === null) {
+        return;
+    }
+    if (!_isDict(self_fix)) {
+        throw new SchemaError(
+            `state.self_fix must be a JSON object or null; ` +
+                `got ${pyTypeName(self_fix)}`,
+        );
+    }
+    for (const [lane, record] of Object.entries(self_fix)) {
+        if (!_isDict(record)) {
+            throw new SchemaError(
+                `state.self_fix.${lane} must be a JSON object; ` +
+                    `got ${pyTypeName(record)}`,
+            );
+        }
+        if ('attempts' in record) {
+            const attempts = record['attempts'];
+            if (
+                typeof attempts !== 'number' ||
+                typeof attempts === 'boolean' ||
+                !Number.isInteger(attempts) ||
+                attempts < 0
+            ) {
+                throw new SchemaError(
+                    `state.self_fix.${lane}.attempts must be a non-negative ` +
+                        `integer when present; got ${pyRepr(attempts)}`,
+                );
+            }
+        }
+        if ('signatures' in record) {
+            const signatures = record['signatures'];
+            if (!Array.isArray(signatures)) {
+                throw new SchemaError(
+                    `state.self_fix.${lane}.signatures must be a list when ` +
+                        `present; got ${pyTypeName(signatures)}`,
+                );
+            }
+            for (const entry of signatures) {
+                if (typeof entry !== 'string') {
+                    throw new SchemaError(
+                        `state.self_fix.${lane}.signatures entries must be ` +
+                            `strings; got ${pyTypeName(entry)}`,
+                    );
+                }
+            }
+        }
+    }
+}
+
 /**
  * Reject malformed `ui_polish` envelopes; tolerate `null` and `{}`.
  *

package/src/agent-src/templates/scripts/work_engine/state_io.ts

@@ -150,6 +150,7 @@ export function _to_delivery(work: WorkState): DeliveryState {
         contract: work.contract as Record<string, DeliveryAny> | null,
         stitch: work.stitch as Record<string, DeliveryAny> | null,
         stack: work.stack as Record<string, DeliveryAny> | null,
+        self_fix: work.self_fix as Record<string, DeliveryAny> | null,
     });
 }
 
@@ -182,6 +183,11 @@ export function _sync_back(work: WorkState, delivery: DeliveryState): void {
     work.contract = delivery.contract as Dict | null;
     work.stitch = delivery.stitch as Dict | null;
     work.stack = delivery.stack as Dict | null;
+    // Reassigned (not mutated) by `record_attempt`, so the defensive mirror
+    // above is load-bearing here rather than a no-op: without this line the
+    // attempt counter would reset on every dispatch and the loop would never
+    // reach either floor.
+    work.self_fix = delivery.self_fix as Dict | null;
 }
 
 /**

package/src/config/cost-parity-budget.json

@@ -0,0 +1,167 @@
+{
+    "_comment": "Committed target table for the road-to-cost-parity-* family (part 0, Phase 1). Registers what a session costs today, what the family is steering toward, and what the rule payload actually is PER HOST — the correction that matters most, because every diet target in the source drafts was set against one aggregate number that describes no host. Nothing here changes behaviour: no carrier ships for these thresholds (part 0 Phase 4.5), and no gate reads the target columns. What IS gated is the file's own shape — lint_budget_ownership rejects a row without a `source`, and rejects a `revised_from` without `revision_evidence`, so a number cannot enter or move without a traceable origin.",
+    "schema_version": 1,
+    "registered_at": "2026-08-10",
+    "owner": "maintainer",
+    "review_by": "2026-11-10",
+    "row_schema": {
+        "_comment": "Reading of part 0 § 1.2b: `schema_version` / `registered_at` / `owner` / `review_by` are FILE-level (as in every sibling budget file — a per-row copy would be four constants repeated N times), and every ROW carries `source` plus the three honest-null fields from § 1.3. The validator enforces exactly that split.",
+        "required_row_fields": ["id", "unit", "baseline", "source", "revisable", "revision_evidence", "revised_from"],
+        "honest_null_contract": "A target bends to a measurement, never to a preference. `revisable: true` says the number is revisable at all; `revised_from` records what it used to be once it moves; `revision_evidence` must then point at the evidence note that forced the move. The validator fails the file when `revised_from` is set and `revision_evidence` is empty — a revision without published evidence is the one form of drift this schema exists to refuse."
+    },
+    "measurement": {
+        "_comment": "Both measurement rules from part 0's Context are fields here, not prose: a rule that lives only in a paragraph is a rule the next author does not inherit.",
+        "measurement_date": "2026-08-10",
+        "commit": "c073d5732fb890bbf8b41ec879f62f651c7ba293",
+        "projection_regenerated": true,
+        "regeneration_command": "task sync && task generate-tools — verified no-op afterwards (git status clean), so the payload rows below measure the commit and not when someone last ran a generator",
+        "emitter_generation": "real, frontmatter-less projection files (25 of 110 .claude/rules entries carry a `paths:` block; the rest carry no frontmatter). NOT the older emitter that symlinked .claude/rules/* into dist/agent-src/rules/ and so inherited dist's full frontmatter. This is the THIRD variable behind the 92-vs-110 file-count spread: a projection count is a fact about which emitter last wrote the tree, on top of how stale that tree is.",
+        "carrier_divergence_admitted": false,
+        "carrier_divergence_reason": "report_carrier_divergence compares a globally installed carrier against the project projection on disk; both can be stale independently, so it measures relative cache staleness rather than any property of the source. It may diagnose a behind-the-times install; it may never gate a phase, and no row here is derived from it."
+    },
+    "session_cost_targets": [
+        {
+            "id": "median_final_context_tokens",
+            "unit": "billable input tokens of the last main-chain assistant record (per cc_transcript.ts)",
+            "baseline": 519349,
+            "interim": 300000,
+            "target": 200000,
+            "direction": "lower_is_better",
+            "source": "agents/evidence/analysis/token-economy-recycling-phase1.md:45 — median over 201 sessions with parseable final usage (:44) out of 205 non-empty (:10)",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "p90_final_context_tokens",
+            "unit": "billable input tokens of the last main-chain assistant record",
+            "baseline": 807937,
+            "interim": 550000,
+            "target": 400000,
+            "direction": "lower_is_better",
+            "source": "agents/evidence/analysis/token-economy-recycling-phase1.md:45 — same 201-session corpus",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "auto_compact_incidence",
+            "unit": "share of sessions with >= 1 auto-compaction event",
+            "baseline": 0.112,
+            "interim": 0.05,
+            "target": 0.0,
+            "direction": "lower_is_better",
+            "source": "agents/evidence/analysis/token-economy-recycling-phase1.md:59 — 23 of 205 sessions, 31 events (:60), all trigger:\"auto\"",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "late_early_per_call_cost_ratio",
+            "unit": "median billable input per call over the last 20 calls / the first 20 calls of a session",
+            "baseline": 2.1,
+            "interim": 1.6,
+            "target": 1.3,
+            "direction": "lower_is_better",
+            "source": "agents/evidence/analysis/token-economy-recycling-phase1.md:69-75 — 145 sessions with >= 200 main-chain calls; median early 279,859 vs late 594,985; p90 ratio 3.3x",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        }
+    ],
+    "payload_rows": [
+        {
+            "_comment": "Per host, never one number. The aggregate the source drafts dieted against (\"419 KB always-loaded layer\") describes no host that exists: it is the whole rule tree, and only 9 of 116 rules are type: always.",
+            "id": "src_rules_maintained",
+            "unit": "bytes across src/rules/*.md",
+            "baseline": 424896,
+            "files": 116,
+            "target_bytes": null,
+            "target_owner": "none — this is the maintained source, not a delivered payload; it shrinks only as a consequence of a diet elsewhere",
+            "source": "measured 2026-08-10 at commit c073d5732, post-regeneration (see `measurement`)",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "dist_agent_src_rules",
+            "unit": "bytes across dist/agent-src/rules/*.md",
+            "baseline": 420051,
+            "files": 115,
+            "target_bytes": null,
+            "target_owner": "none — the tracked projection source. It is the ONLY rule-payload figure that is stable across checkouts, because it is committed; every other row below is regenerated and therefore machine-dependent.",
+            "source": "measured 2026-08-10 at commit c073d5732, post-regeneration",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "augment_rules_payload",
+            "unit": "bytes across .augment/rules/*.md",
+            "baseline": 420051,
+            "files": 115,
+            "target_bytes": null,
+            "target_owner": "src/config/budgets.yml § standing_rule_delivery (total_cap_tokens 110000) already owns the delivered-rule ceiling. This family does not open a second, byte-denominated target for the same surface — a metric with two owners is a metric with none.",
+            "source": "measured 2026-08-10 at commit c073d5732, post-regeneration; mirrors dist/ by symlink",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "claude_rules_payload",
+            "unit": "bytes across .claude/rules/*.md",
+            "baseline": 339035,
+            "files": 110,
+            "target_bytes": null,
+            "target_owner": "src/config/budgets.yml § standing_rule_delivery — same ceiling, same reason as the augment row",
+            "source": "measured 2026-08-10 at commit c073d5732, post-regeneration; 25 of 110 files carry a `paths:` block, the rest none",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "_comment": "CORRECTION to part 0's triage table, which recorded these two as \"~3 KB / ~0 KB\" and therefore as already-lean hosts needing no target. Re-measured post-regeneration they are 408 KB and 330 KB — a full payload each. The earlier reading is a stale-projection artefact of exactly the class measurement rule 1 warns about: both carriers are UNTRACKED and written only by `task generate-tools`, so a checkout that has not run it reads them as near-empty. Risk 3's mitigation (\"the lean hosts need no target\") does not survive the re-measure and is not encoded here.",
+            "id": "clinerules_payload",
+            "unit": "bytes across .clinerules/*.md",
+            "baseline": 417703,
+            "files": 111,
+            "target_bytes": null,
+            "target_owner": "unowned — a diet for this host belongs to the parked rule-payload part of this family, not to part 0",
+            "source": "measured 2026-08-10 at commit c073d5732, post-regeneration; untracked, generated by task generate-tools",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "windsurfrules_payload",
+            "unit": "bytes of the single .windsurfrules file",
+            "baseline": 338160,
+            "files": 1,
+            "target_bytes": null,
+            "target_owner": "unowned — see the clinerules row; same correction, same parked owner",
+            "source": "measured 2026-08-10 at commit c073d5732, post-regeneration; untracked, generated by task generate-tools",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "gemini_md_payload",
+            "unit": "bytes of GEMINI.md",
+            "baseline": 2982,
+            "files": 1,
+            "target_bytes": null,
+            "target_owner": "none — genuinely lean, and the only host in this table for which that is true. It is a pointer file, not a rule payload.",
+            "source": "measured 2026-08-10 at commit c073d5732, post-regeneration",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        }
+    ],
+    "anchors": {
+        "premium_band_tokens": 200000,
+        "rationale": "Above ~200k a session sits in the premium pricing band, which is why the median target is set there rather than at a round fraction of the baseline.",
+        "known_noise_problem": "187 of 205 observed sessions end at or above 200k, so a session-end hint at this threshold would fire on ~91% of sessions — a constant line, not an advisory. The 200k figure is a TARGET here and nothing else.",
+        "no_carrier_ships": "Part 0 § 4.5: no session-end advisory ships for this anchor. The existing 800k recycle threshold (src/config/recycle-threshold-budget.json) stays the only strong line, and any carrier for 200k is a separate, separately-argued change.",
+        "source": "agents/evidence/analysis/token-economy-recycling-phase1.md — session-final distribution (:45) over the 205-session corpus (:10)"
+    }
+}

package/src/config/gate-coverage.yml

@@ -40,13 +40,16 @@
 #                visible, or it repeats the sin it exists to catch.
 #   canary       optional mutation recipe (Phase 7) — see CANARY below
 #
-# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-05)
+# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-10)
 # ----------------------------------------------------------
-# 240 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
+# 251 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
 # (the count is computed, not asserted — `check_gate_coverage.count_gate_scripts`).
-# **32 of them emit the machine-readable `scanned: <N>` line under their
-# CI-identical argv, and all 31 are listed below.** The manifest is therefore
+# **33 of them emit the machine-readable `scanned: <N>` line under their
+# CI-identical argv, and all 33 are listed below.** The manifest is therefore
 # complete with respect to its own contract, and covers ~13 % of the population.
+# (The 2026-08-05 reading said "32 … and all 31 are listed": the two halves of
+# one sentence disagreed by one, which is the drift this paragraph exists to
+# make visible. Both are recounted above, not adjusted toward each other.)
 #
 # Two revisions of this header have now gone stale the same way. It claimed
 # "8 of 211", then "22 of 223" while 26 entries were listed. Both halves drift
@@ -98,7 +101,7 @@
 # which is the shape this repo tells a gate author to use — writes the line from
 # inside the library, so its own source never matches and the test cannot see it.
 # Live split: **1 unregistered gate emits the inline shape (`check_gate_coverage`
-# itself), and 175 of 244 gate scripts emit through the helper.** So for the
+# itself), and 205 of 251 gate scripts emit through the helper.** So for the
 # recommended shape the sentence above is false, and the list CAN fall behind.
 #
 # Not widened here, deliberately. Widening the regex to include the helper turns
@@ -557,6 +560,42 @@ gates:
       untouched original stayed clean. Floor at 450 against a live 503 leaves
       room for skill retirement without redding the change that retires one.
 
+  - id: lint_workflow_paths
+    argv: []
+    min_scanned: 20
+    corpus: "every workflow under .github/workflows (28 at baseline); the unit is the file, and each file's `paths:` / `paths-ignore:` entries are resolved against `git ls-files`"
+    status: enforced
+    canary:
+      class: undetected-antipattern
+      path: .github/workflows/zz-canary-workflow-paths.yml
+      content: |
+        name: Canary
+        on:
+          pull_request:
+            paths:
+              - "retired/tree/that/never/existed/**"
+        jobs:
+          noop:
+            runs-on: ubuntu-latest
+            steps:
+              - run: echo canary
+    note: >
+      Registered STRICT on day one for the same reason `lint_example_fences`
+      was, and on the same evidence standard: the classification pass ran
+      BEFORE the gate existed and returned **20 dead entries across 6 workflow
+      files**, each classified by hand into one of four causes — a tree retired
+      by ADR-051, a gitignored projection that can never appear in a diff, two
+      paths moved by the Python-to-TS migration, and bare root paths whose real
+      files sit under `src/`. All 20 were repaired in the change that added the
+      gate, so the corpus is verified empty rather than unexamined, and an
+      advisory gate over it could only ever be ignored. Floor at 20 against a
+      live 28 so retiring a workflow does not red the change that retires it.
+      Worth recording that the highest-severity hit was invisible to the hand
+      census and only the gate found it: `release-validation.yml` filtered on a
+      root `marketplace.json` that has never existed, so a version drift in the
+      real manifest did not re-trigger the `version-consistency` job whose
+      entire purpose is catching that drift.
+
   - id: check_depth_budget
     argv: []
     min_scanned: 140

package/src/config/quorum-attendance-budget.json

@@ -0,0 +1,39 @@
+{
+    "_comment": "Pre-registered council ATTENDANCE metrics (road-to-inbox-harvest-2026-08-b Phase 1.4). Registered here rather than in roadmap prose because a roadmap is archived when it closes and a metric outlives it — the sibling budget files (hook-token-budget.json, recycle-threshold-budget.json) already carry the owner / review_by / honest-gap discipline this reuses. The instrument is the quorum_result line appendQuorumEvent writes to agents/runtime/council/events.log (schema v2); nothing here is measured yet, and no threshold is committed before data exists.",
+    "schema_version": 1,
+    "registered_at": "2026-08-10",
+    "owner": "maintainer",
+    "review_by": "2026-11-10",
+    "unit": "quorum_result event lines in agents/runtime/council/events.log",
+    "privacy": "a quorum_result line carries {phase, command, dispatch, verdict, threshold, configured_total, total, present, solo, absent[{member, reason}]} — counts, closed vocabularies, and member ids only. The type has no field able to hold free-form content, so the CLI's own `detail` string (provider error text, which can embed paths and prompt fragments) is dropped at the boundary rather than scrubbed.",
+    "phase_split": "A pass emits `pre_run` (build_members — who could be constructed) and, on the `run` path, `post_run` (_postRunQuorum — who actually returned a usable response). They disagree whenever a member constructs and then fails mid-flight, so a rate computed over both double-counts. A `pre_run` line is NOT evidence a pass ran: `command: estimate` is a spend-free preview, and a `run` / `debate` line is written before the `--confirm` gate (which defaults to false and returns before any provider call) and before the necessity and size-fit gates. A `post_run` line is the only line that proves providers were called — which is why every rate below is post_run-scoped, and why `command` exists at all.",
+    "attendance_rate": {
+        "definition": "of the members that entered the pass, how many answered: present / total per post_run pass. Bounded by 1 by construction (evaluateQuorum clamps present into [0, total]).",
+        "instrument": "quorum_result lines, phase=post_run, command=run, fields present + total",
+        "threshold": "none committed before data — baseline first, threshold at review date"
+    },
+    "roster_shortfall_rate": {
+        "definition": "how often the council shrank BEFORE the pass: share of post_run passes with total < configured_total, plus the size of the gap. This is the half attendance_rate cannot see — a pass with 3 configured, 2 failing to construct and 1 answering reads 1/1 = 100 % attendance and a shortfall of 2. Both numbers are needed and neither substitutes for the other; a single ratio over mixed rosters is the error this pair replaces.",
+        "instrument": "quorum_result lines, phase=post_run, command=run, configured_total vs total",
+        "threshold": "none committed before data — baseline first, threshold at review date",
+        "not_an_error": "total > configured_total is legitimate and not a shortfall: `--siblings` fans ONE enabled config entry into N clients, so the client roster can exceed the entry count. configured_total counts enabled config ENTRIES; total counts CLIENTS. Compare them for direction, never divide one by the other."
+    },
+    "solo_conclusion_rate": {
+        "definition": "share of post_run passes with `solo: true` — written by the isSoloConcluded predicate in quorum.ts, never re-derived from the numbers here, so one change to the rule cannot leave this definition stale. ceil(n/2) makes 1-of-2 a legitimate conclusion; this measures how often that legitimacy is used, not whether it should be. THREE cases carry solo: true and they are not the same finding — a degraded multi-member council (configured_total > 1), a council configured with one member (configured_total = 1, dispatch = full), and a deliberate --single dispatch (dispatch = single). Split on dispatch and configured_total before reading the rate.",
+        "instrument": "quorum_result lines, phase=post_run, command=run, field solo, split by dispatch + configured_total",
+        "threshold": "none committed before data. The quorum-solo-floor blocker pre-registers the three outcomes this rate decides between — a third CLI member, a gate-scoped min_present: 2, or a published null under 5 % — and that choice is made against real data, never ahead of it. It is decided on the degraded case only; a --single pass is the operator asking for one voice, not the council failing to assemble."
+    },
+    "absent_reason_distribution": {
+        "definition": "count per reason over absent[] entries — no_binary / no_auth / timeout / quota (AbsentReason) plus the two runtime fallbacks the CLI writes directly, `unavailable` (transport resolved to nothing) and `binary_missing` (a CLI client refused to construct). Distinguishes a council degraded by configuration from one degraded by provider behaviour, which have opposite fixes.",
+        "instrument": "quorum_result lines, absent[].reason, split by phase (a pre_run absence is configuration; a post_run absence is mid-flight). Excluding `command: estimate` is NOT sufficient: `run` and `debate` also reach construction and return at the `--confirm` gate, which defaults to false. The reliable filter is a pre_run line whose pass produced a matching post_run line; a pre_run line with no post_run partner reached construction and stopped there, whatever its command says.",
+        "threshold": "none committed before data — the distribution IS the finding at review date",
+        "merge_before_reading": "`no_binary` and `binary_missing` are two spellings of one condition — the CLI binary is unusable — written by different code paths (transport_resolver's static classification vs the CLI client's construction failure). They are recorded separately because that is what the tree emits, not because they are separate findings; merge them before reading the distribution, or the largest bucket is split in two."
+    },
+    "honest_null_consequence": "If the log accumulates and the solo-conclusion rate sits near zero, that is the published answer to the quorum-solo-floor blocker and 1.5 is cancelled against it — not quietly dropped. If attendance data never accumulates at all (nobody runs a metered council pass in the window), that is reported as an unmeasured metric at the review date, never as a passing one.",
+    "honest_gaps": [
+        "`lens` and `invocation` are empty on every pre_run line — neither is known at member-construction time — so any per-lens breakdown is post_run-only.",
+        "`command: debate` carries the pre_run half ONLY. There is no _postRunQuorum on the debate path, and defining `usable response` for a multi-round debate is a separate question this registration does not answer. So debate contributes to absent_reason_distribution and to nothing else: attendance_rate and solo_conclusion_rate cover the `run` path, and a reader must not read them as covering every metered pass.",
+        "A pre_run line proves construction happened, never that a pass followed — the `--confirm` gate (default false), the necessity gate and the size-fit gate all abort afterwards and nothing on the line records it. Any count over pre_run lines is an upper bound; pair it with a post_run line before treating it as a pass.",
+        "The CLI emit wiring itself has no test. The two modules are covered directly, but nothing exercises build_members / cmd_run / cmd_debate end-to-end against a captured log — and `_emitQuorumEvent` forwards no AppendEventOptions, so there is no target to capture into. Two defects in this file's first version (a `dispatch` written from the flag rather than the outcome, and a rate mixing config entries with clients) were found by review rather than by a test, which is what that gap costs."
+    ]
+}