@event4u/agent-config 9.33.0 → 9.34.0

package/dist/hooks/dispatch.js

@@ -7993,7 +7993,7 @@ function* iter_corpus(roots = DEFAULT_SCAN_ROOTS, exts = [".md"]) {
 function report(findings, opts) {
   const check_label = opts.check_label;
   if (findings.length === 0) {
-    process.stdout.write(`\u2705  ${check_label}: clean (${_corpus_note()}).
+    process.stdout.write(`\u2705  ${check_label}: clean (${_corpus_note(opts.scanned_roots)}).
 `);
     return 0;
   }
@@ -8033,8 +8033,9 @@ function _pyG(n) {
   }
   return s;
 }
-function _corpus_note() {
-  return "scanned " + DEFAULT_SCAN_ROOTS.join(", ");
+function _corpus_note(scanned_roots) {
+  const roots = scanned_roots && scanned_roots.length > 0 ? scanned_roots : DEFAULT_SCAN_ROOTS;
+  return "scanned " + roots.join(", ");
 }
 var PyFloat = class {
   constructor(value) {
@@ -16205,6 +16206,38 @@ function hasBoundaryMarker(block) {
   // outside the datamarking while still riding in the same block.
   block.trimEnd().endsWith(ENVELOPE_BOUNDARY_CLOSE);
 }
+var DECISION_REVERSIBILITY_TAGS = ["reversible", "irreversible"];
+function decisionTagErrors(decisions) {
+  if (!Array.isArray(decisions)) {
+    return [];
+  }
+  const errors = [];
+  for (const line of decisions) {
+    if (typeof line !== "string") {
+      continue;
+    }
+    const m = /\[([^\]]*)\]\s*$/.exec(line.trimEnd());
+    if (m === null) {
+      continue;
+    }
+    const inner = (m[1] ?? "").trim();
+    const lowered = inner.toLowerCase();
+    if (DECISION_REVERSIBILITY_TAGS.includes(lowered)) {
+      if (inner !== lowered) {
+        errors.push(
+          `decisions: reversibility tag must be lower-case \u2014 got \`[${inner}]\`, expected \`[${lowered}]\``
+        );
+      }
+      continue;
+    }
+    if (/^i?rr?ever[a-z]*[^a-z]*$/i.test(lowered)) {
+      errors.push(
+        `decisions: \`[${inner}]\` is not a reversibility tag \u2014 use exactly ` + DECISION_REVERSIBILITY_TAGS.map((t) => `\`[${t}]\``).join(" or ") + ", or drop the bracket"
+      );
+    }
+  }
+  return errors;
+}
 var RECYCLE_ENVELOPE_KEYS = /* @__PURE__ */ new Set([
   "capsule_version",
   "variant",
@@ -16217,6 +16250,7 @@ var RECYCLE_ENVELOPE_KEYS = /* @__PURE__ */ new Set([
   "not_carried_forward",
   "decisions",
   "constraints",
+  "do_not_touch",
   "open_worker_envelopes",
   "artifact_paths",
   "assumptions",
@@ -16269,7 +16303,9 @@ function validateRecycleEnvelope(input) {
   checkList(errors, "remaining", e["remaining"], MAX_LINE_CHARS, true);
   checkList(errors, "not_carried_forward", e["not_carried_forward"], MAX_LINE_CHARS, true);
   checkList(errors, "decisions", e["decisions"], MAX_LINE_CHARS, false);
+  errors.push(...decisionTagErrors(e["decisions"]));
   checkList(errors, "constraints", e["constraints"], MAX_LINE_CHARS, false);
+  checkList(errors, "do_not_touch", e["do_not_touch"], MAX_REF_CHARS, false);
   checkList(errors, "open_worker_envelopes", e["open_worker_envelopes"], MAX_REF_CHARS, false);
   checkList(errors, "artifact_paths", e["artifact_paths"], MAX_REF_CHARS, false);
   checkList(errors, "suggested_skills", e["suggested_skills"], MAX_REF_CHARS, false);
@@ -18839,6 +18875,12 @@ function claude_config_dir() {
   return env !== "" ? env : path32.join(os4.homedir(), ".claude");
 }
 
+// src/scripts/_lib/env_kill_switch.ts
+var _OFF_VALUES = /* @__PURE__ */ new Set(["", "0", "false", "False"]);
+function isEnvKillSwitchActive(name) {
+  return !_OFF_VALUES.has(process.env[name] ?? "");
+}
+
 // src/scripts/ai_team/config.ts
 var TeamConfigError = class extends Error {
   constructor(message) {
@@ -19048,8 +19090,7 @@ function circuit_breaker_notice(bound) {
   return `\u26A0\uFE0F team review-gate circuit breaker: ${bound} consecutive BLOCK verdict(s) this session (bound: \`ai_team.review_gate.max_consecutive_blocks\`). The managed gate stops re-blocking now \u2014 you decide: review the last BLOCK reason via \`/team:status\`, fix what is real, ignore what is not. An ALLOW verdict resets the counter.`;
 }
 function _kill_switch_active() {
-  const value = process.env[_KILL_SWITCH_ENV] ?? "";
-  return !(value === "" || value === "0" || value === "false" || value === "False");
+  return isEnvKillSwitchActive(_KILL_SWITCH_ENV);
 }
 function _iso_seconds_z(d) {
   const pad = (n, w = 2) => String(n).padStart(w, "0");
@@ -19930,6 +19971,28 @@ function fingerprint2(defect_class, evidence) {
   const shape = evidence.toLowerCase().replace(/\d+/g, "#").replace(/[`"'‚'„"»«]/g, "").replace(/[^a-zà-ÿ#\s]/g, " ").replace(/\s+/g, " ").trim();
   return createHash4("sha256").update(`${defect_class}|${shape}`).digest("hex").slice(0, 16);
 }
+var NEW_RECORDS_PER_SOURCE_PER_WINDOW = 20;
+var CREATION_WINDOW_MS = 24 * 60 * 60 * 1e3;
+function recentCreations(existing, source, now) {
+  const end = Date.parse(now);
+  if (Number.isNaN(end)) {
+    return 0;
+  }
+  return existing.filter((r) => {
+    if (r.source !== source) {
+      return false;
+    }
+    const t = Date.parse(r.first_seen);
+    return Number.isNaN(t) || end - t < CREATION_WINDOW_MS && end - t >= 0;
+  }).length;
+}
+function creationCapReached(existing, finding, now) {
+  const fp = fingerprint2(finding.defect_class, finding.evidence);
+  if (existing.some((r) => r.fingerprint === fp)) {
+    return false;
+  }
+  return recentCreations(existing, finding.source, now) >= NEW_RECORDS_PER_SOURCE_PER_WINDOW;
+}
 function mergeRecord(existing, finding, now) {
   const fp = fingerprint2(finding.defect_class, finding.evidence);
   if (existing !== null && existing.fingerprint === fp) {
@@ -19995,7 +20058,7 @@ function listRecords(root) {
   }
   const out = [];
   for (const n of names.sort()) {
-    if (!n.endsWith(".json")) {
+    if (!n.endsWith(".json") || n === OVERFLOW_FILE) {
       continue;
     }
     const rec = readRecord(root, n.slice(0, -".json".length));
@@ -20009,9 +20072,35 @@ function listRecords(root) {
 function openRecords(root) {
   return listRecords(root).filter((r) => r.status === "open");
 }
+var OVERFLOW_FILE = "_overflow.json";
+function overflowPath(root) {
+  return path38.join(storeDir(root), OVERFLOW_FILE);
+}
+function readOverflow(root) {
+  try {
+    const parsed = JSON.parse(fs37.readFileSync(overflowPath(root), "utf-8"));
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function bumpOverflow(root, source, now) {
+  const counts = readOverflow(root);
+  const prev = counts[source]?.dropped ?? 0;
+  counts[source] = { dropped: prev + 1, last_seen: now };
+  const dir = storeDir(root);
+  fs37.mkdirSync(dir, { recursive: true });
+  fs37.writeFileSync(overflowPath(root), `${JSON.stringify(counts, null, 2)}
+`, "utf-8");
+}
 function upsertFinding(root, finding, now) {
   const fp = fingerprint2(finding.defect_class, finding.evidence);
-  const merged = mergeRecord(readRecord(root, fp), finding, now);
+  const existing = readRecord(root, fp);
+  if (existing === null && creationCapReached(listRecords(root), finding, now)) {
+    bumpOverflow(root, finding.source, now);
+    return null;
+  }
+  const merged = mergeRecord(existing, finding, now);
   writeRecord(root, merged);
   return merged;
 }

package/dist/mcp/registry-manifest.json

@@ -1,7 +1,7 @@
 {
   "discovery": {
     "artefact_count": 603,
-    "scanner_version": "c24312e116f8"
+    "scanner_version": "1eaf68b6e9c9"
   },
   "generated_at": "2026-08-11",
   "package": {
@@ -9,7 +9,7 @@
     "homepage": "https://event4u-app.github.io/agent-config",
     "name": "@event4u/agent-config",
     "repository": "https://github.com/event4u-app/agent-config",
-    "version": "9.33.0"
+    "version": "9.34.0"
   },
   "registries": [
     {

package/dist/mcp/server.json

@@ -9,12 +9,12 @@
       "transport": {
         "type": "stdio"
       },
-      "version": "9.33.0"
+      "version": "9.34.0"
     }
   ],
   "repository": {
     "source": "github",
     "url": "https://github.com/event4u-app/agent-config"
   },
-  "version": "9.33.0"
+  "version": "9.34.0"
 }

package/dist/mcp/server.mjs

@@ -9241,7 +9241,7 @@ function* iter_corpus(roots = DEFAULT_SCAN_ROOTS, exts = [".md"]) {
 function report(findings, opts) {
   const check_label = opts.check_label;
   if (findings.length === 0) {
-    process.stdout.write(`\u2705  ${check_label}: clean (${_corpus_note()}).
+    process.stdout.write(`\u2705  ${check_label}: clean (${_corpus_note(opts.scanned_roots)}).
 `);
     return 0;
   }
@@ -9281,8 +9281,9 @@ function _pyG(n) {
   }
   return s;
 }
-function _corpus_note() {
-  return "scanned " + DEFAULT_SCAN_ROOTS.join(", ");
+function _corpus_note(scanned_roots) {
+  const roots = scanned_roots && scanned_roots.length > 0 ? scanned_roots : DEFAULT_SCAN_ROOTS;
+  return "scanned " + roots.join(", ");
 }
 function _isPlainObject(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v) && !(v instanceof PyFloat);
@@ -15361,7 +15362,7 @@ function lint_execution_metadata(execution) {
   }
   return issues;
 }
-function lint_skill(p, text) {
+function lint_skill(p, text, absPath = null) {
   const issues = [];
   const suggestions = [];
   const sections = extract_sections(text);
@@ -15371,6 +15372,18 @@ function lint_skill(p, text) {
       issues.push(new Issue("error", "missing_section", `Missing required section: ${section}`));
     }
   }
+  const skillDir = absPath !== null ? path19.dirname(absPath) : path19.isAbsolute(p) ? path19.dirname(p) : null;
+  for (const { section, when, reason } of CONDITIONAL_SKILL_SECTIONS) {
+    if (skillDir !== null && when(skillDir) && !sectionMatches(section, sections)) {
+      issues.push(
+        new Issue(
+          "error",
+          "missing_conditional_section",
+          `Missing required section: ${section} (${reason})`
+        )
+      );
+    }
+  }
   for (const section of RECOMMENDED_SKILL_SECTIONS) {
     if (!sectionMatches(section, sections)) {
       issues.push(
@@ -17173,7 +17186,7 @@ function lint_file(p, repoRoot = null) {
   }
   let result;
   if (artifactType === "skill") {
-    result = lint_skill(displayPath, text);
+    result = lint_skill(displayPath, text, p);
   } else if (artifactType === "rule") {
     result = lint_rule(displayPath, text);
   } else if (artifactType === "command") {
@@ -17998,7 +18011,7 @@ function _isCliEntry7() {
     return false;
   }
 }
-var _HERE4, REQUIRED_PERSONA_SECTIONS_CORE, REQUIRED_PERSONA_SECTIONS_SPECIALIST, VALID_PERSONA_TIERS, PERSONA_LINE_BUDGETS, REQUIRED_USERTYPE_SECTIONS, USERTYPE_LINE_BUDGET, VALID_PERSONA_WINGS, PERSONA_LINE_BUDGETS_BY_WING, REQUIRED_SKILL_SECTIONS, SECTION_ALIASES, RECOMMENDED_SKILL_SECTIONS, RULE_BAD_SIGNS, FRUGALITY_WRITER_SKILLS, FRUGALITY_CHARTER_RELPATH, FRUGALITY_CHARTER_INDEX_RULES, VAGUE_VALIDATION_PATTERNS, TRIGGER_WARNING_PATTERNS, ORDERED_STEP_PATTERN, SECTION_PATTERN, FRONTMATTER_PATTERN, DESCRIPTION_PATTERN, STATUS_PATTERN, REPLACED_BY_PATTERN, TIER_PATTERN, TYPE_PATTERN, SOURCE_PATTERN, SENIOR_RELATED_SKILLS_PATTERN, SENIOR_RELATED_WHEN_PATTERN, SENIOR_RELATED_WHEN_NOT_PATTERN, SENIOR_PROACTIVE_PATTERN, SENIOR_OUTPUT_PATTERN, H1_PATTERN, DOUBLE_BLANK_PATTERN, VALID_RULE_TYPES, VALID_RULE_SOURCES, ROUTER_ALLOWED_TRIGGER_KEYS, KERNEL_RULE_IDS2, VALID_EXECUTION_TYPES, VALID_EXECUTION_HANDLERS, VALID_EXECUTION_SAFETY_MODES, VALID_EXECUTION_FIELDS, WING3_SPINE_SLOTS, CONTEXT_SPINE_INLINE_PATTERN, WING3_SAAS_URL_PATTERN, WING3_VENDOR_BLACKLIST, WING3_STACK_LOCKED_PATTERN, WING3_CHANNEL_TACTIC_PATTERN, WING4_SPINE_SLOTS, WING4_SAAS_URL_PATTERN, WING4_VENDOR_BLACKLIST, WING4_STAGE_AGNOSTIC_PATTERN, Issue, LintResult, _ROLE_CONTRACT_CANDIDATES, _ROLE_CONTRACT_SLUGS_CACHE, _ROLE_CONTRACT_REF_PATTERN, PROCEDURE_HEADING_PATTERN, COMMAND_FRONTMATTER_DELEGATION_KEYS, MD_LINK_PATTERN_G, NAME_PATTERN, DISABLE_MODEL_PATTERN, _INSPECT_VERB_PATTERN, last_changed_scope_reason, last_changed_base_diff_ok, _INTERACTION_NAME_PATTERNS, _INTERACTION_CONTENT_KEYWORDS, _EXEC_FILE_SIGNALS, _EXEC_CONTENT_SIGNALS, _TASK_TYPE_SIGNALS, _VERIFICATION_TOOLS, _FRUGALITY_STANDARDS_PATTERN, _FRUGALITY_CHARTER_LINK_PATTERN, _MD_LINK_PATTERN, _MALICE_CRED_EXFIL, _MALICE_REMOTE_EXEC, _MALICE_FORCE_PUSH, _MALICE_CHMOD_SECRETS, _MALICE_SHELL_INJECT, _MALICE_PATTERNS, _NAG_UPDATE_CHECK, _NAG_STAY_CURRENT, _NAG_SELF_PROMO, _NAG_BEST_SKILL, _NAG_MUST_USE, _NAG_ALWAYS_USE, _NAG_PATTERNS, _OUTPUT_SCHEMA_KEY_PATTERN, _SCHEMA_ARTEFACT_TYPES, ArgError, isCliEntry2;
+var _HERE4, REQUIRED_PERSONA_SECTIONS_CORE, REQUIRED_PERSONA_SECTIONS_SPECIALIST, VALID_PERSONA_TIERS, PERSONA_LINE_BUDGETS, REQUIRED_USERTYPE_SECTIONS, USERTYPE_LINE_BUDGET, VALID_PERSONA_WINGS, PERSONA_LINE_BUDGETS_BY_WING, REQUIRED_SKILL_SECTIONS, SECTION_ALIASES, RECOMMENDED_SKILL_SECTIONS, CONDITIONAL_SKILL_SECTIONS, RULE_BAD_SIGNS, FRUGALITY_WRITER_SKILLS, FRUGALITY_CHARTER_RELPATH, FRUGALITY_CHARTER_INDEX_RULES, VAGUE_VALIDATION_PATTERNS, TRIGGER_WARNING_PATTERNS, ORDERED_STEP_PATTERN, SECTION_PATTERN, FRONTMATTER_PATTERN, DESCRIPTION_PATTERN, STATUS_PATTERN, REPLACED_BY_PATTERN, TIER_PATTERN, TYPE_PATTERN, SOURCE_PATTERN, SENIOR_RELATED_SKILLS_PATTERN, SENIOR_RELATED_WHEN_PATTERN, SENIOR_RELATED_WHEN_NOT_PATTERN, SENIOR_PROACTIVE_PATTERN, SENIOR_OUTPUT_PATTERN, H1_PATTERN, DOUBLE_BLANK_PATTERN, VALID_RULE_TYPES, VALID_RULE_SOURCES, ROUTER_ALLOWED_TRIGGER_KEYS, KERNEL_RULE_IDS2, VALID_EXECUTION_TYPES, VALID_EXECUTION_HANDLERS, VALID_EXECUTION_SAFETY_MODES, VALID_EXECUTION_FIELDS, WING3_SPINE_SLOTS, CONTEXT_SPINE_INLINE_PATTERN, WING3_SAAS_URL_PATTERN, WING3_VENDOR_BLACKLIST, WING3_STACK_LOCKED_PATTERN, WING3_CHANNEL_TACTIC_PATTERN, WING4_SPINE_SLOTS, WING4_SAAS_URL_PATTERN, WING4_VENDOR_BLACKLIST, WING4_STAGE_AGNOSTIC_PATTERN, Issue, LintResult, _ROLE_CONTRACT_CANDIDATES, _ROLE_CONTRACT_SLUGS_CACHE, _ROLE_CONTRACT_REF_PATTERN, PROCEDURE_HEADING_PATTERN, COMMAND_FRONTMATTER_DELEGATION_KEYS, MD_LINK_PATTERN_G, NAME_PATTERN, DISABLE_MODEL_PATTERN, _INSPECT_VERB_PATTERN, last_changed_scope_reason, last_changed_base_diff_ok, _INTERACTION_NAME_PATTERNS, _INTERACTION_CONTENT_KEYWORDS, _EXEC_FILE_SIGNALS, _EXEC_CONTENT_SIGNALS, _TASK_TYPE_SIGNALS, _VERIFICATION_TOOLS, _FRUGALITY_STANDARDS_PATTERN, _FRUGALITY_CHARTER_LINK_PATTERN, _MD_LINK_PATTERN, _MALICE_CRED_EXFIL, _MALICE_REMOTE_EXEC, _MALICE_FORCE_PUSH, _MALICE_CHMOD_SECRETS, _MALICE_SHELL_INJECT, _MALICE_PATTERNS, _NAG_UPDATE_CHECK, _NAG_STAY_CURRENT, _NAG_SELF_PROMO, _NAG_BEST_SKILL, _NAG_MUST_USE, _NAG_ALWAYS_USE, _NAG_PATTERNS, _OUTPUT_SCHEMA_KEY_PATTERN, _SCHEMA_ARTEFACT_TYPES, ArgError, isCliEntry2;
 var init_skill_linter = __esm({
   "src/scripts/skill_linter.ts"() {
     "use strict";
@@ -18046,6 +18059,22 @@ var init_skill_linter = __esm({
       "Output format": /* @__PURE__ */ new Set(["Output format", "Output"])
     };
     RECOMMENDED_SKILL_SECTIONS = [];
+    CONDITIONAL_SKILL_SECTIONS = [
+      {
+        section: "Security constraints",
+        // `isDirectory()`, not `existsSync` — a FILE named `scripts` would satisfy
+        // an existence test while shipping no script at all, and the predicate is
+        // only false-positive-free because it means what it says.
+        when: (skillDir) => {
+          try {
+            return fs19.statSync(path19.join(skillDir, "scripts")).isDirectory();
+          } catch {
+            return false;
+          }
+        },
+        reason: "the skill ships a scripts/ directory"
+      }
+    ];
     RULE_BAD_SIGNS = ["## Procedure", "## Output format", "## Gotchas"];
     FRUGALITY_WRITER_SKILLS = /* @__PURE__ */ new Set([
       "skill-writing",
@@ -19486,6 +19515,7 @@ __export(archive_completed_roadmaps_exports, {
   _branch_touched_paths: () => _branch_touched_paths,
   _git_mv: () => _git_mv,
   _inbound_ref_rewrite: () => _inbound_ref_rewrite,
+  _is_frozen_record: () => _is_frozen_record,
   _repo_root: () => _repo_root,
   archive_completed: () => archive_completed,
   main: () => main10
@@ -19535,6 +19565,10 @@ function _branch_touched_paths(root, base) {
   }
   return out;
 }
+function _is_frozen_record(rel) {
+  const norm = rel.split(path22.sep).join("/");
+  return _FROZEN_RECORD_PREFIXES.some((p) => norm.startsWith(p)) || norm.endsWith(".patch");
+}
 function _inbound_ref_rewrite(root, old_rel, new_rel, dry_run, tracked = true) {
   const changed = [];
   let candidates;
@@ -19552,6 +19586,9 @@ function _inbound_ref_rewrite(root, old_rel, new_rel, dry_run, tracked = true) {
     if (!rel || rel === old_rel) {
       continue;
     }
+    if (_is_frozen_record(rel)) {
+      continue;
+    }
     const fp = path22.join(root, rel);
     let text;
     try {
@@ -19781,7 +19818,7 @@ function _isCliEntry10() {
     return false;
   }
 }
-var _HERE6, ArgparseExit2, _PROG6;
+var _HERE6, ArgparseExit2, _FROZEN_RECORD_PREFIXES, _PROG6;
 var init_archive_completed_roadmaps = __esm({
   "src/agent-src/scripts/archive_completed_roadmaps.ts"() {
     "use strict";
@@ -19795,6 +19832,7 @@ var init_archive_completed_roadmaps = __esm({
         this.code = code;
       }
     };
+    _FROZEN_RECORD_PREFIXES = ["agents/evidence/"];
     _PROG6 = "archive_completed_roadmaps.py";
     if (_isCliEntry10() || process9.argv[1] === _HERE6) {
       try {
@@ -25344,6 +25382,18 @@ var init_session_role = __esm({
   }
 });
 
+// src/scripts/_lib/env_kill_switch.ts
+function isEnvKillSwitchActive(name) {
+  return !_OFF_VALUES.has(process.env[name] ?? "");
+}
+var _OFF_VALUES;
+var init_env_kill_switch = __esm({
+  "src/scripts/_lib/env_kill_switch.ts"() {
+    "use strict";
+    _OFF_VALUES = /* @__PURE__ */ new Set(["", "0", "false", "False"]);
+  }
+});
+
 // src/scripts/ai_council/quorum.ts
 function resolveQuorumThreshold(total, setting = "majority") {
   if (!Number.isInteger(total) || total < 0) {
@@ -25430,8 +25480,7 @@ function _utf8Bytes(cp) {
   );
 }
 function _kill_switch_active() {
-  const value = process.env[_KILL_SWITCH_ENV] ?? "";
-  return !(value === "" || value === "0" || value === "false" || value === "False");
+  return isEnvKillSwitchActive(_KILL_SWITCH_ENV);
 }
 function appendEvent(event, opts = {}) {
   if (_kill_switch_active()) {
@@ -25593,6 +25642,7 @@ var SCHEMA_VERSION6, _VALID_ACTIONS, _KILL_SWITCH_ENV, _HERE15, _REPO_ROOT, _DEF
 var init_events_log = __esm({
   "src/scripts/ai_council/events_log.ts"() {
     "use strict";
+    init_env_kill_switch();
     init_quorum();
     SCHEMA_VERSION6 = 2;
     _VALID_ACTIONS = /* @__PURE__ */ new Set([
@@ -29945,6 +29995,7 @@ var init_review_gate = __esm({
   "src/scripts/ai_team/review_gate.ts"() {
     "use strict";
     init_claude_plugin();
+    init_env_kill_switch();
     init_state_io();
     init_config2();
     GATE_LEDGER_RELPATH = path50.join("agents", "runtime", "team", "events.log");
@@ -37947,6 +37998,49 @@ function synthesis_template(mode) {
     `Unknown synthesis mode ${_pyRepr9(mode)}. Expected one of: [${expected.map((m) => _pyReprStr2(m)).join(", ")}]`
   );
 }
+function parse_verdict_line(text) {
+  _VERDICT_RE.lastIndex = 0;
+  let last = null;
+  let m;
+  while ((m = _VERDICT_RE.exec(text)) !== null) {
+    last = m;
+  }
+  if (last === null) {
+    return null;
+  }
+  const raw = (last[1] ?? "").trim();
+  if (raw.length === 0) {
+    return null;
+  }
+  if (/^<.*>$/.test(raw)) {
+    return null;
+  }
+  return { label: raw.toLowerCase(), display: raw };
+}
+function describe_verdict_mismatch(text, tally) {
+  const verdict = parse_verdict_line(text);
+  if (verdict === null) {
+    return null;
+  }
+  const optionNamedSplit = tally.options.some(
+    (o) => o.label.toLowerCase() === SPLIT_VERDICT_LABEL
+  );
+  const claimsSplit = verdict.label === SPLIT_VERDICT_LABEL && !optionNamedSplit;
+  if (tally.consensus === null) {
+    if (claimsSplit) {
+      return null;
+    }
+    const how = tally.split ? `split across ${tally.options.length} option(s)` : "no option-level stances parsed";
+    return `synthesis claims "${verdict.display}" but the tally recorded no consensus (${how}); use \`${SPLIT_VERDICT_LABEL}\` or re-run the round`;
+  }
+  if (claimsSplit) {
+    return `synthesis claims a split but the tally cleared "${tally.consensus.label}"`;
+  }
+  if (verdict.label !== tally.consensus.label.toLowerCase()) {
+    return `synthesis claims "${verdict.display}" but the tally cleared "${tally.consensus.label}"`;
+  }
+  return null;
+}
 function _strip_host_identity(text) {
   if (!text) {
     return text;
@@ -38043,7 +38137,7 @@ ${text}`);
 function peer_review_synthesis_addendum() {
   return PEER_REVIEW_SYNTHESIS_ADDENDUM;
 }
-var NEUTRALITY_PREAMBLE, HOST_AGENT_IDENTITY_PATTERNS, PROMPT_MODE, ROADMAP_MODE, DIFF_MODE, FILES_MODE, PR_MODE, DESIGN_MODE, OPTIMIZE_MODE, ANALYSIS_MODE, DEBATE_MODE, STANCE_LINE_CONTRACT, ANTI_CONFORMITY_DIRECTIVE, _MODE_TABLE, FINDING_EXTRACTION_PROMPT, FINDING_SCORING_PROMPT, DEFAULT_SYNTHESIS, PR_SYNTHESIS, ANALYSIS_SYNTHESIS, CREATIVE_SYNTHESIS, _SYNTHESIS_TABLE, _INPUT_MODE_TO_SYNTHESIS_KEY, PEER_REVIEW_PROMPT, PEER_REVIEW_SYNTHESIS_ADDENDUM;
+var NEUTRALITY_PREAMBLE, HOST_AGENT_IDENTITY_PATTERNS, PROMPT_MODE, ROADMAP_MODE, DIFF_MODE, FILES_MODE, PR_MODE, DESIGN_MODE, OPTIMIZE_MODE, ANALYSIS_MODE, DEBATE_MODE, STANCE_LINE_CONTRACT, ANTI_CONFORMITY_DIRECTIVE, _MODE_TABLE, FINDING_EXTRACTION_PROMPT, FINDING_SCORING_PROMPT, DEFAULT_SYNTHESIS, PR_SYNTHESIS, ANALYSIS_SYNTHESIS, CREATIVE_SYNTHESIS, _SYNTHESIS_TABLE, _INPUT_MODE_TO_SYNTHESIS_KEY, SPLIT_VERDICT_LABEL, _VERDICT_RE, VERDICT_LINE_CONTRACT, PEER_REVIEW_PROMPT, PEER_REVIEW_SYNTHESIS_ADDENDUM;
 var init_prompts2 = __esm({
   "src/scripts/ai_council/prompts.ts"() {
     "use strict";
@@ -38307,6 +38401,11 @@ turn.`;
       diff: "default",
       files: "default"
     };
+    SPLIT_VERDICT_LABEL = "split";
+    _VERDICT_RE = /^\s*VERDICT:\s*(.+?)\s*$/gm;
+    VERDICT_LINE_CONTRACT = `Close the synthesis with EXACTLY this line, and nothing after it:
+VERDICT: <option-label>
+Use the SAME <option-label> the Vote Tally cleared. Use \`${SPLIT_VERDICT_LABEL}\` when no option cleared the threshold \u2014 an honest split is a verdict, and claiming a winner the tally did not record is a render error.`;
     PEER_REVIEW_PROMPT = `Below are responses from other independent reviewers to the same
 artefact you just reviewed. Each is labelled with a neutral identifier
 (\`Response-A\`, \`Response-B\`, \u2026). You do NOT know which model produced
@@ -41809,6 +41908,11 @@ ${addendum}` : _pyLStrip(addendum);
     template = template ? `${template}
 
 ${CHAIRMAN_FIELDS_ADDENDUM}` : CHAIRMAN_FIELDS_ADDENDUM;
+  }
+  if (opts.stance_tally === true && template !== "") {
+    template = `${template}
+
+${VERDICT_LINE_CONTRACT}`;
   }
   let body;
   if (template) {
@@ -41831,6 +41935,10 @@ ${body}`;
       responses.filter((r) => !r.error).map((r) => ({ member: `${r.provider}:${r.model}`, text: r.text }))
     );
     blocks.push(render_vote_tally(tally));
+    const mismatch = describe_verdict_mismatch(body, tally);
+    if (mismatch !== null) {
+      blocks.push(`> **Verdict/tally mismatch:** ${mismatch}`);
+    }
   }
   blocks.push(`## Convergence / Divergence
 

package/docs/guidelines/agent-infra/failure-signatures.md

@@ -12,18 +12,53 @@ probability cause.
 
 ## Lookup
 
-| Signature (what you see) | Likely cause | First check |
-|---|---|---|
-| **Tool/agent loop** — same tool called >2× with near-identical args, no progress | Missing stop condition; reading without acting; ambiguous state | Stop. State the hypothesis in one line. Act or ask — do not re-read. (`context-hygiene` 15/25 rule) |
-| **HTTP 429 / "rate limit" / "quota"** | Too-frequent calls; shared quota; missing backoff | Inspect response headers (`Retry-After`, `X-RateLimit-*`); add exponential backoff; check if a loop is firing the calls |
-| **`ECONNREFUSED` / connection refused** | Service not up; wrong host/port; container not started | Is the service running? (`docker compose ps`, health endpoint); is the port right? (`lsof -i :PORT`); is it bound to `127.0.0.1` vs `0.0.0.0`? |
-| **`ENOENT` / "no such file or directory"** | Wrong cwd; path relative vs absolute; file not generated yet | Print the *resolved absolute* path; check cwd; confirm a prior step actually wrote the file |
-| **Timeout / hang** | Blocking I/O; deadlock; awaiting a condition that never holds | What is it waiting on? Add a log right before the blocking call; bound the wait; check for a missing `await`/`return` |
-| **`OOM` / killed (137) / heap out of memory** | Unbounded collection; loading all rows; leak in a loop | What grows per iteration? Stream/paginate instead of loading all; check `--max-old-space-size` only after finding the growth |
-| **`EACCES` / permission denied** | Wrong file mode; running as wrong user; read-only mount | `ls -l` the target; check the process user; is the path a read-only volume? |
-| **Flaky test (passes alone, fails in suite)** | Shared state; order dependence; real clock/random; unawaited async | Run the test in isolation vs in suite; look for shared fixtures, global state, `Date.now()`/random, missing `await` |
-| **Works locally, fails in CI** | Env/config drift; missing service; absent secret; path/case sensitivity | Diff env (`printenv`); is the service/secret present in CI? Linux is case-sensitive — check filename casing |
-| **Intermittent / "sometimes"** | Race; timing; network; non-deterministic order | Reproduce with condition-based waiting, not fixed sleeps (`systematic-debugging` § Condition-based waiting); log timestamps |
+| ID | Signature (what you see) | Likely cause | First check |
+|---|---|---|---|
+| `tool-loop` | **Tool/agent loop** — same tool called >2× with near-identical args, no progress | Missing stop condition; reading without acting; ambiguous state | Stop. State the hypothesis in one line. Act or ask — do not re-read. (`context-hygiene` 15/25 rule) |
+| `rate-limited` | **HTTP 429 / "rate limit" / "quota"** | Too-frequent calls; shared quota; missing backoff | Inspect response headers (`Retry-After`, `X-RateLimit-*`); add exponential backoff; check if a loop is firing the calls |
+| `connection-refused` | **`ECONNREFUSED` / connection refused** | Service not up; wrong host/port; container not started | Is the service running? (`docker compose ps`, health endpoint); is the port right? (`lsof -i :PORT`); is it bound to `127.0.0.1` vs `0.0.0.0`? |
+| `path-not-found` | **`ENOENT` / "no such file or directory"** | Wrong cwd; path relative vs absolute; file not generated yet | Print the *resolved absolute* path; check cwd; confirm a prior step actually wrote the file |
+| `hang` | **Timeout / hang** | Blocking I/O; deadlock; awaiting a condition that never holds | What is it waiting on? Add a log right before the blocking call; bound the wait; check for a missing `await`/`return` |
+| `out-of-memory` | **`OOM` / killed (137) / heap out of memory** | Unbounded collection; loading all rows; leak in a loop | What grows per iteration? Stream/paginate instead of loading all; check `--max-old-space-size` only after finding the growth |
+| `permission-denied` | **`EACCES` / permission denied** | Wrong file mode; running as wrong user; read-only mount | `ls -l` the target; check the process user; is the path a read-only volume? |
+| `order-dependent-test` | **Flaky test (passes alone, fails in suite)** | Shared state; order dependence; real clock/random; unawaited async | Run the test in isolation vs in suite; look for shared fixtures, global state, `Date.now()`/random, missing `await` |
+| `local-ci-drift` | **Works locally, fails in CI** | Env/config drift; missing service; absent secret; path/case sensitivity | Diff env (`printenv`); is the service/secret present in CI? Linux is case-sensitive — check filename casing |
+| `race` | **Intermittent / "sometimes"** | Race; timing; network; non-deterministic order | Reproduce with condition-based waiting, not fixed sleeps (`systematic-debugging` § Condition-based waiting); log timestamps |
+| `stale-capability-claim` | **Budget exhausted plus repeated attempts at a tool that is not available** | A capability the session claimed for itself instead of resolving — the council, a hook slot, a subagent primitive, an MCP server assumed present | Ask the live verb, not the tree: `agent-config hooks:status` for slot bindings, `agent-config routing:doctor` for per-field capability **provenance** (`registry` / `live-probe` / `default`), `agent-config council:status` for council availability. A `false` from `default` records that nobody answered, not that the host cannot |
+
+### Naming convention for IDs
+
+An id is a short kebab handle so a signature can be **cited by name** — the
+first column was prose, so nothing could reference a row.
+
+One rule governs new ids: **where a row's signature is a stable string the
+tooling already prints, the id is that string verbatim** rather than a kebab
+synonym. `skill_linter.ts` emits a closed set of `Issue` codes —
+`missing_section`, `missing_conditional_section`, `invalid_execution_handler` —
+and a row about one of those is looked up by the code the reader just saw in the
+output. No current row is of that class; the convention is stated for the next
+one, so the table does not accumulate two names for the same failure.
+
+## Discrimination drills
+
+A row's "first check" is only worth following if the documented signature is what
+actually appears. Each drill breaks the named layer and asserts the documented
+symptom — run it once when you doubt a row, or when adding one. They are text a
+human runs; nothing here is a CI gate.
+
+| ID | Drill — break this, expect that |
+|---|---|
+| `tool-loop` | Ask for a fact that is genuinely absent from the tree (a config key nothing defines). Expect repeated searches with shrinking variation and no edit — that shape, not an error message, is the signature. |
+| `rate-limited` | Fire the provider's own rate limit with a tight loop against a cheap endpoint. Expect `429` **plus** `Retry-After`; a `429` with no such header is a different failure (a gateway, not the API). |
+| `connection-refused` | Stop the service and call it (`docker compose stop <svc>`). Expect `ECONNREFUSED` immediately. If it hangs instead, the host resolves but nothing listens — that is `hang`, not this row. |
+| `path-not-found` | Run a path-taking script from a different cwd. Expect `ENOENT` naming a path that is *almost* right — the near-miss is the tell that the path is relative, not missing. |
+| `hang` | `await` a promise nothing resolves. Expect no output and no exit, distinguishable from `race` by being 100% reproducible. |
+| `out-of-memory` | Accumulate rows in an array inside a loop over a large fixture. Expect the heap message and exit 137 — and note that the reported line is where allocation failed, not where the growth is. |
+| `permission-denied` | `chmod 000` a fixture and read it. Expect `EACCES`, not `ENOENT` — confusing the two sends you looking for a missing file that is right there. |
+| `order-dependent-test` | Add a module-level mutable to two tests in one file. Expect green alone, red in suite. Reversing the file order should move the failure — if it does not, the cause is shared *external* state, not order. |
+| `local-ci-drift` | Rename a fixture's casing (`Foo.ts` → `foo.ts`) and import the old name. Expect green on macOS, red on Linux CI. The generalisation: anything the local filesystem is lenient about. |
+| `race` | Replace a condition-based wait with a fixed `sleep` shorter than the operation. Expect intermittent failure whose rate moves with machine load — load-sensitivity is what separates this from `order-dependent-test`. |
+| `stale-capability-claim` | Assert a capability without asking for it, then compare against the live verb. `agent-config routing:doctor` prints provenance per field; a field whose provenance is `default` was never established by anything — which is exactly the state a confident self-claim is indistinguishable from. |
 
 ## How to use
 

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "9.33.0",
+    "version": "9.34.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
     "license": "MIT",
     "private": false,
@@ -77,7 +77,7 @@
         "build:mcp-catalog": "./scripts-run src/scripts/build_mcp_catalog --write --strict",
         "build": "npm run build:cli && npm run build:install-bundle && npm run build:hooks && npm run build:mcp-bundle && npm run build:cli-delegate && npm run build:ui",
         "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.scripts.json",
-        "lint:ts": "eslint 'src/**/*.ts'",
+        "lint:ts": "eslint --cache 'src/**/*.ts'",
         "test:ts": "vitest run",
         "lint:publint": "publint",
         "prepack": "npm run build && npm run build:discovery && npm run build:mcp-manifest && node src/scripts/prepack-check.mjs",

package/src/agent-src/scripts/archive_completed_roadmaps.ts

@@ -128,12 +128,42 @@ function _branch_touched_paths(root: string, base: string): Set<string> | null {
     return out;
 }
 
+/**
+ * Paths where a repo-relative path is DATA, not a live reference — so
+ * rewriting it falsifies a record instead of keeping a link resolvable.
+ *
+ * Two classes, and the second is why this predicate exists at all:
+ *
+ * - `agents/evidence/**` — a committed record of what was true, or of what a
+ *   reviewer was shown, at one point in time. Retroactively editing it makes it
+ *   claim something that did not happen, which is the failure
+ *   `evaluator-independence` exists to prevent ("the prompt ships with the
+ *   verdict" is worthless if a later sweep can edit the prompt).
+ * - `*.patch` anywhere — a patch's `diff --git a/… b/…` and `+++ b/…` lines are
+ *   the payload. Rewriting them detaches the patch from the commit it records
+ *   AND makes `git apply` target a path the diff never created.
+ *
+ * Measured 2026-08-11: archiving one roadmap rewrote four frozen artefacts
+ * under `agents/evidence/reviews/`, including the `diff.patch` headers of a
+ * recorded review input. Nothing caught it — the sweep reported it as
+ * "4 ref(s) migrated", which reads like success.
+ */
+const _FROZEN_RECORD_PREFIXES: readonly string[] = ['agents/evidence/'];
+
+/** Is `rel` a frozen record whose path strings must not be rewritten? */
+export function _is_frozen_record(rel: string): boolean {
+    const norm = rel.split(path.sep).join('/');
+    return _FROZEN_RECORD_PREFIXES.some((p) => norm.startsWith(p)) || norm.endsWith('.patch');
+}
+
 /**
  * Rewrite full-path references `old_rel` → `new_rel` in tracked files.
  *
  * Only the exact repo-relative path is rewritten (bare-filename mentions are
  * left alone). The archived file's own path never matches because the search
- * string is the un-archived path.
+ * string is the un-archived path. Frozen records are skipped — see
+ * `_is_frozen_record`; a link left dangling in a historical record is correct,
+ * because the record describes a tree that no longer exists.
  */
 function _inbound_ref_rewrite(
     root: string,
@@ -165,6 +195,10 @@ function _inbound_ref_rewrite(
             // skip the roadmap file itself
             continue;
         }
+        if (_is_frozen_record(rel)) {
+            // A record of a past state — rewriting it falsifies the record.
+            continue;
+        }
         const fp = path.join(root, rel);
         let text: string;
         try {

package/src/config/quorum-attendance-budget.json

@@ -21,7 +21,7 @@
     "solo_conclusion_rate": {
         "definition": "share of post_run passes with `solo: true` — written by the isSoloConcluded predicate in quorum.ts, never re-derived from the numbers here, so one change to the rule cannot leave this definition stale. ceil(n/2) makes 1-of-2 a legitimate conclusion; this measures how often that legitimacy is used, not whether it should be. THREE cases carry solo: true and they are not the same finding — a degraded multi-member council (configured_total > 1), a council configured with one member (configured_total = 1, dispatch = full), and a deliberate --single dispatch (dispatch = single). Split on dispatch and configured_total before reading the rate.",
         "instrument": "quorum_result lines, phase=post_run, command=run, field solo, split by dispatch + configured_total",
-        "threshold": "none committed before data. The quorum-solo-floor blocker pre-registers the three outcomes this rate decides between — a third CLI member, a gate-scoped min_present: 2, or a published null under 5 % — and that choice is made against real data, never ahead of it. It is decided on the degraded case only; a --single pass is the operator asking for one voice, not the council failing to assemble."
+        "threshold": "DECIDED 2026-08-11 against real data — see ADR-224 (docs/decisions/ADR-224-gate-scoped-solo-attendance-floor.md). The quorum-solo-floor blocker pre-registered three outcomes — a third CLI member, a gate-scoped min_present: 2, or a published null under 5 %. Read at 2026-08-11T09:30Z with the definition above: 1 of 8 post_run/command=run passes carried a degraded solo conclusion = 12.5 %, so the under-5 % null did not fire and the gate-scoped floor was chosen (council 2/2). It was decided on the degraded case only; a --single pass is the operator asking for one voice, not the council failing to assemble. Still no numeric threshold is committed here, deliberately: at n=8 the 95 % interval around 1/8 spans roughly 0.3 %-53 %, so the rate established urgency and not certainty, and ADR-224's review trigger reopens the null at n=40. What this metric measures does NOT change; once the floor lands, how often it FIRES is a second and different question needing its own instrument."
     },
     "absent_reason_distribution": {
         "definition": "count per reason over absent[] entries — no_binary / no_auth / timeout / quota (AbsentReason) plus the two runtime fallbacks the CLI writes directly, `unavailable` (transport resolved to nothing) and `binary_missing` (a CLI client refused to construct). Distinguishes a council degraded by configuration from one degraded by provider behaviour, which have opposite fixes.",

package/src/scripts/_cli/cmd_session_recycle.ts

@@ -57,8 +57,13 @@ export function templateEnvelope(): Record<string, unknown> {
         acceptance_criteria: ['<what done means, one line each>'],
         remaining: ['<open work, one line each>'],
         not_carried_forward: ['<what the successor must re-derive from source>'],
-        decisions: ['<decision — one-line rationale>'],
+        decisions: ['<decision — one-line rationale> [reversible]'],
         constraints: ['<binding constraint>'],
+        // Ships EMPTY, unlike the prose lists above: the entries are path refs,
+        // and a `<placeholder>` left in by a hurried writer would be a fake path
+        // rather than obvious filler. An empty list is also the honest default —
+        // nothing off limits is the common case.
+        do_not_touch: [],
         open_worker_envelopes: [],
         artifact_paths: ['<path to a deliverable / note / evidence file>'],
         assumptions: [],