@event4u/agent-config 9.33.0 → 9.35.0

package/dist/agent-src/scripts/archive_completed_roadmaps.ts

@@ -128,12 +128,42 @@ function _branch_touched_paths(root: string, base: string): Set<string> | null {
     return out;
 }
 
+/**
+ * Paths where a repo-relative path is DATA, not a live reference — so
+ * rewriting it falsifies a record instead of keeping a link resolvable.
+ *
+ * Two classes, and the second is why this predicate exists at all:
+ *
+ * - `agents/evidence/**` — a committed record of what was true, or of what a
+ *   reviewer was shown, at one point in time. Retroactively editing it makes it
+ *   claim something that did not happen, which is the failure
+ *   `evaluator-independence` exists to prevent ("the prompt ships with the
+ *   verdict" is worthless if a later sweep can edit the prompt).
+ * - `*.patch` anywhere — a patch's `diff --git a/… b/…` and `+++ b/…` lines are
+ *   the payload. Rewriting them detaches the patch from the commit it records
+ *   AND makes `git apply` target a path the diff never created.
+ *
+ * Measured 2026-08-11: archiving one roadmap rewrote four frozen artefacts
+ * under `agents/evidence/reviews/`, including the `diff.patch` headers of a
+ * recorded review input. Nothing caught it — the sweep reported it as
+ * "4 ref(s) migrated", which reads like success.
+ */
+const _FROZEN_RECORD_PREFIXES: readonly string[] = ['agents/evidence/'];
+
+/** Is `rel` a frozen record whose path strings must not be rewritten? */
+export function _is_frozen_record(rel: string): boolean {
+    const norm = rel.split(path.sep).join('/');
+    return _FROZEN_RECORD_PREFIXES.some((p) => norm.startsWith(p)) || norm.endsWith('.patch');
+}
+
 /**
  * Rewrite full-path references `old_rel` → `new_rel` in tracked files.
  *
  * Only the exact repo-relative path is rewritten (bare-filename mentions are
  * left alone). The archived file's own path never matches because the search
- * string is the un-archived path.
+ * string is the un-archived path. Frozen records are skipped — see
+ * `_is_frozen_record`; a link left dangling in a historical record is correct,
+ * because the record describes a tree that no longer exists.
  */
 function _inbound_ref_rewrite(
     root: string,
@@ -165,6 +195,10 @@ function _inbound_ref_rewrite(
             // skip the roadmap file itself
             continue;
         }
+        if (_is_frozen_record(rel)) {
+            // A record of a past state — rewriting it falsifies the record.
+            continue;
+        }
         const fp = path.join(root, rel);
         let text: string;
         try {

package/dist/agent-src/scripts/roadmap_gates.ts

@@ -46,6 +46,13 @@
  *   ./agent-config gates --all      # every open blocker, grouped by owner
  *   ./agent-config gates --json     # machine-readable
  *   ./agent-config gates --reply    # reply-close form; empty when none
+ *   ./agent-config gates --pending  # staged actions awaiting confirmation
+ *
+ * `--pending` reads a different source — the staged-confirmation store, not the
+ * roadmap tree — and stays out of `--reply` on purpose. ADR-222 fixes the
+ * reply-close form at exactly ONE decision rendered in full; folding a second
+ * source into it would silently change which decision "the one" is, and that
+ * contract is not this step's to move.
  */
 
 import * as path from 'node:path';
@@ -58,6 +65,8 @@ import {
     blocker_needs_user as needsUser,
     type Blocker,
 } from './update_roadmap_progress.js';
+import { listPending } from '../templates/scripts/work_engine/hooks/builtin/staged_confirmation_store.js';
+import type { StagedAction } from '../templates/scripts/work_engine/hooks/builtin/staged_confirmation.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 
@@ -327,6 +336,89 @@ function renderJson(entries: readonly Entry[], all: boolean): string {
     );
 }
 
+/**
+ * `--pending`: staged actions awaiting a human confirmation.
+ *
+ * A second source under the same verb, and the reason it belongs here rather
+ * than in a new command is the verb's own definition — "open decisions that
+ * need you, as actions". A staged irreversible action IS one, and the most
+ * literal kind: the roadmap blockers above are decisions a human owes a plan,
+ * this is a decision a human owes an action that is already loaded and waiting.
+ *
+ * Expired stages are counted, never listed as actionable. An expired stage
+ * cannot execute (`stageStatus` derives that from the clock, not from a sweep
+ * having run), so rendering it beside a live one would put two rows in front of
+ * the reader where only one is a decision.
+ */
+function renderPending(root: string, now: number): string {
+    const rows = listPending(root, now);
+    const live = rows.filter((r) => r.status === 'pending');
+    const expired = rows.filter((r) => r.status === 'expired');
+    const lines: string[] = [];
+
+    if (live.length === 0) {
+        lines.push(
+            expired.length === 0
+                ? 'No staged actions awaiting confirmation.'
+                : `Nothing awaits your confirmation. ${expired.length} stage` +
+                      `${expired.length !== 1 ? 's' : ''} expired unconfirmed — the action never fired.`,
+        );
+        return lines.join('\n') + '\n';
+    }
+
+    lines.push(
+        `${live.length} staged action${live.length !== 1 ? 's' : ''} await` +
+            `${live.length === 1 ? 's' : ''} your confirmation` +
+            (expired.length > 0 ? ` · ${expired.length} expired unconfirmed` : ''),
+    );
+    let n = 0;
+    for (const { stage } of live) {
+        n += 1;
+        lines.push(...renderStage(stage, n));
+    }
+    lines.push('');
+    return lines.join('\n') + '\n';
+}
+
+function renderStage(stage: StagedAction, index: number): string[] {
+    const head = `${index} · ${stage.action}`;
+    const tail = `token: ${stage.token}`;
+    const dashes = Math.max(3, WIDTH - head.length - tail.length - 6);
+    return [
+        '',
+        `── ${head} ${'─'.repeat(dashes)} ${tail}`.trimEnd(),
+        // The object is the first field on purpose: an approval that does not
+        // name the exact object is the thing non-destructive-by-default forbids,
+        // so it is what the reader must see before anything else.
+        ...field('Object:', stage.object),
+        ...field('Staged by:', stage.source),
+        ...field('Expires:', stage.expires_at),
+    ];
+}
+
+function renderPendingJson(root: string, now: number): string {
+    const rows = listPending(root, now);
+    return (
+        JSON.stringify(
+            {
+                awaitingYou: rows.filter((r) => r.status === 'pending').length,
+                expired: rows.filter((r) => r.status === 'expired').length,
+                staged: rows.map(({ stage, status }) => ({
+                    token: stage.token,
+                    action: stage.action,
+                    object: stage.object,
+                    source: stage.source,
+                    stagedAt: stage.staged_at,
+                    expiresAt: stage.expires_at,
+                    status,
+                })),
+            },
+            null,
+            2,
+        ) + '\n'
+    );
+}
+
 function _isDir(p: string): boolean {
     try {
         return fs.statSync(p).isDirectory();
@@ -340,8 +432,8 @@ function _isDir(p: string): boolean {
  * `agents/roadmaps`, otherwise fall back to the git toplevel (monorepo
  * sub-project support).
  */
-function _resolveRepoRoot(start: string): string {
-    if (_isDir(path.join(start, 'agents', 'roadmaps'))) {
+function _resolveRepoRoot(start: string, marker = path.join('agents', 'roadmaps')): string {
+    if (_isDir(path.join(start, marker))) {
         return start;
     }
     try {
@@ -351,7 +443,7 @@ function _resolveRepoRoot(start: string): string {
             timeout: 10_000,
         });
         const top = (r.stdout || '').trim();
-        if (r.status === 0 && top !== '' && _isDir(path.join(top, 'agents', 'roadmaps'))) {
+        if (r.status === 0 && top !== '' && _isDir(path.join(top, marker))) {
             return top;
         }
     } catch {
@@ -365,6 +457,18 @@ function main(argv?: readonly string[]): number {
     const all = args.includes('--all');
     const json = args.includes('--json');
     const reply = args.includes('--reply');
+    const pending = args.includes('--pending');
+
+    // `--pending` resolves against `agents/runtime/`, not `agents/roadmaps/`,
+    // and is answered BEFORE the roadmaps-directory exit below: a staged action
+    // is independent of whether this project plans in roadmaps at all, so
+    // "no roadmaps here" is not an answer to "what awaits my confirmation".
+    if (pending) {
+        const root = _resolveRepoRoot(process.cwd(), path.join('agents', 'runtime'));
+        const now = Date.now();
+        process.stdout.write(json ? renderPendingJson(root, now) : renderPending(root, now));
+        return 0;
+    }
 
     const repoRoot = _resolveRepoRoot(process.cwd());
     const roadmapRoot = path.join(repoRoot, 'agents', 'roadmaps');
@@ -412,5 +516,16 @@ if (_isCliEntry()) {
     process.exitCode = main();
 }
 
-export { main, needsUser, regroupTodo, wrap, collectEntries, render, renderJson, renderReply };
+export {
+    main,
+    needsUser,
+    regroupTodo,
+    wrap,
+    collectEntries,
+    render,
+    renderJson,
+    renderReply,
+    renderPending,
+    renderPendingJson,
+};
 export type { Entry };

package/dist/agent-src/skills/corpus-grounding/SKILL.md

@@ -184,18 +184,27 @@ Each domain ships `data/manifest.json` beside its CSVs — declaring its
 - BM25 tokenizer drops tokens ≤2 chars — "UI", "a11y" style queries need
   longer companions.
 
-## Runtime-safety review (Step 1.6 record)
-
-- **Read-only by default** — the engine opens corpus CSVs under the
-  manifest's directory only (`resolve_data_path` refuses absolute paths
-  and `..` escapes).
-- **Single write surface** — `--persist DIR` (opt-in) writes markdown
-  under the caller-chosen `DIR`; nothing else writes.
-- **No network, no subprocess, no secrets** — pure stdlib; embeddings /
-  remote retrievers are intentionally not implemented (ADR-061 §2).
-- `rules_module` executes a manifest-adjacent TypeScript module (dynamic
-  `import()`) — same trust domain as the skill that ships the manifest;
-  containment enforced by `resolve_data_path`.
+## Security constraints (Step 1.6 runtime-safety record)
+
+Four scripts ship under `scripts/`: `ground.ts` (CLI), `bm25_search.ts`,
+`decision_engine.ts`, `schema_validator.ts`.
+
+- **What they may touch** — corpus CSVs and the manifest under the
+  manifest's own directory. `resolve_data_path` refuses absolute paths and
+  `..` escapes, so the manifest directory is the read boundary.
+- **What they must never do** — read outside that directory, reach the
+  network, or spawn a subprocess. Embeddings and remote retrievers are
+  intentionally not implemented (ADR-061 §2), and that is a containment
+  decision, not a missing feature.
+- **Default invocation** — read-only. The single write surface is opt-in
+  `--persist DIR`, which writes `MASTER.md` (and `pages/<page>.md` when
+  `--page` is given) under `DIR/design-system/<project-slug>/`. Nothing
+  else writes.
+- **Outbound** — nothing. No network access at all.
+
+One qualified exception: `rules_module` executes a manifest-adjacent
+TypeScript module via dynamic `import()`. That is the same trust domain as
+the skill shipping the manifest, and its containment is `resolve_data_path`.
 
 ## See also
 

package/dist/agent-src/skills/design-tokens/SKILL.md

@@ -113,6 +113,21 @@ four-operation split assigns to *rules/linters*, not the corpus).
 3. `validate` report — exit 0 evidence, or the violations list handed to
    the polish round as `token_violation` findings.
 
+## Security constraints
+
+`scripts/tokens.ts` is the only shipped script.
+
+- **What it may touch** — the `tokens.json` config path it is given, the
+  directory it is asked to `validate`, and the `--output` path it is asked
+  to write. Nothing outside the paths named on the command line.
+- **What it must never do** — reach the network, spawn a subprocess, or
+  write to a path the caller did not name. It never edits the generated CSS
+  it produced earlier; regeneration replaces, it does not patch.
+- **Default invocation** — read-only. `generate` prints to stdout unless
+  `--output PATH` is passed; `--output` is the flag that makes it mutating,
+  and it creates only that file's parent directory. `validate` never writes.
+- **Outbound** — nothing. No network access.
+
 ## Do NOT
 
 - Do NOT hand-edit generated CSS — `tokens.json` is the single source.

package/dist/agent-src/skills/react-shadcn-ui/SKILL.md

@@ -299,6 +299,30 @@ carve-out for the tool-specific part.
   values the component no longer accepts is stale documentation; keep them beside
   the component and update them in the same change.
 
+## Security constraints
+
+`scripts/shadcn_add.ts` is the only shipped script, and it is the single
+subprocess-plus-network surface in this suite — treat it accordingly.
+
+- **What it may touch** — the project rooted at `--project-root` (default
+  `cwd`): it reads `components.json` there and lets the upstream CLI write
+  the generated primitives under that root. Nothing outside it.
+- **What it must never do** — run without the exact `npx` command and the
+  component list having been shown to the user first, per the gate above.
+  Never pass `--overwrite` unprompted; never treat a non-zero exit as
+  success; never work around a missing `npx` silently
+  ([`missing-tool-handling`](../../rules/missing-tool-handling.md)).
+- **Default invocation** — mutating. A bare `shadcn_add <component>`
+  spawns `npx shadcn@latest add <component>` and writes into the project.
+  `--dry-run` is the read-only path and prints the command it would run;
+  `--list` is read-only too. Use `--dry-run` for the proposal step.
+- **Outbound** — yes, and this is the point of the gate: `npx` resolves
+  `shadcn@latest` from the public npm registry on every live run, so both
+  the code fetched and the components written are chosen upstream, at run
+  time, not pinned here. That is the egress leg of the lethal trifecta
+  ([`lethal-trifecta-guard`](../../rules/lethal-trifecta-guard.md)); the
+  human confirmation is what keeps it off an autonomous path.
+
 ## Do NOT
 
 - Do NOT install `shadcn-ui` from npm — primitives are scaffolded.

package/dist/agent-src/skills/rule-writing/SKILL.md

@@ -355,3 +355,26 @@ Good description (trigger-shaped, names domain + symptoms):
 Bad description (no trigger, too vague):
 
 > "Commit conventions"
+
+### Contrastive-example slot (optional, for the rule body)
+
+The pair above governs descriptions. A rule whose obligation is easy to agree
+with and hard to apply — what counts as a cheap question, when an interrupt is
+an interrupt, which reply mirrors the user's language — needs the same treatment
+for the **behaviour**, not just the frontmatter.
+
+Six live corpora already carry those pairs:
+[`direct-answers-demos`](../../../docs/guidelines/agent-infra/direct-answers-demos.md),
+[`asking-and-brevity-examples`](../../../docs/guidelines/agent-infra/asking-and-brevity-examples.md),
+[`language-and-tone-examples`](../../../docs/guidelines/agent-infra/language-and-tone-examples.md),
+and `autonomy-examples` / `interrupt-examples` / `cheap-question-mechanics` under
+`src/agent-src/contexts/execution/`. Follow one; do not invent a format.
+
+The shape they share: the **wrong** version in the form it actually gets
+written, the **right** version, and one line of **why** — the why is what makes
+it a rule rather than a memorised case.
+
+Where the pairs go is a size decision, not a taste one. A rule body is capped at
+200 lines hard / 120 soft, so more than two or three pairs belong in a guideline
+or context file the rule points at — same split
+[`skill-writing`](../skill-writing/SKILL.md) § Contrastive-example slot uses.

package/dist/agent-src/skills/skill-writing/SKILL.md

@@ -530,7 +530,7 @@ tool skill*, **never** a new skill per pitfall and never a generated grid (see
 [`size-enforcement`](../../rules/size-enforcement.md) § Per-tool pitfall
 content).
 
-## Rationalizations-to-reject section (required, security-stop-routed skills)
+## Rationalizations-to-reject section (recommended pattern, security-stop-routed skills)
 
 A skill routed by `security-sensitive-stop` already carries a forbidden-moves or
 failure-mode list. Those describe **what is wrong**. They do not answer the
@@ -553,7 +553,7 @@ the skip actually happens.
 Keep it to the arguments that have really been made. An invented rationalization
 teaches nothing and dilutes the ones that recur.
 
-## Non-negotiable-deliverable section (required, adjacent-technology clusters)
+## Non-negotiable-deliverable section (recommended pattern, adjacent-technology clusters)
 
 Some skills sit next to a technology that is a *tempting wrong answer* — close
 enough to look interchangeable, different enough that picking it silently loses
@@ -644,6 +644,84 @@ This duplicates the rules on purpose, and the duplication is the point: the
 rules are the enforcement, the section is what survives the artifact leaving
 their reach.
 
+## Mechanism-teaching section (optional pattern, skills whose subject has one)
+
+A procedure tells the agent what to do in the cases you thought of. A
+**mechanism** tells it why those steps work, which is the only thing that
+transfers to the case you did not. Where a skill's subject has a mechanism worth
+one screen — how the cascade resolves, why the queue drops the message, what the
+scheduler actually orders — state it in a `## How it works` section, ahead of the
+procedure that depends on it.
+
+Keep it to one screen and to mechanisms only: no history, no alternatives-considered,
+no restating the procedure in prose. If it takes more than a screen, the skill is
+carrying a guideline's worth of material and should point at one instead.
+
+The test for whether it earns its place: name a plausible situation the procedure
+does not cover, and check whether this section is enough to answer it. If the
+answer is still "read the source", the section is decoration.
+
+Optional, and it gets no gate: "teaches a mechanism" is a prose judgement, and a
+predicate over prose is the false-positive class this file's other patterns avoid.
+
+## Illustrative-not-verbatim marker (optional pattern, reference code)
+
+A code block in a skill is read as copy-me by default. When a block is teaching a
+*shape* — a signature to mirror, a structure to follow, pseudocode standing in for
+the real call — say so on the line above it:
+
+```
+<!-- illustrative: shape only, not a working snippet -->
+```
+
+One line, immediately above the fence, in the skill's own words if you prefer.
+What matters is that the reader can tell shape-teaching code from code that runs,
+because the failure mode is silent: an agent pastes the illustration, it almost
+works, and the debugging starts from the wrong premise.
+
+The inverse deserves the same care — a block that IS meant to be run verbatim,
+where a reader might assume otherwise, says so too. See also `### 4. Add
+safe/unsafe example`, which governs a different axis: safe-vs-unsafe, not
+runnable-vs-illustrative.
+
+## Headline metric + closing report (optional pattern, optimization skills)
+
+A skill whose job is to make something better — smaller, faster, cheaper, quieter
+— has to say **which single number it moves**. Without one, "optimized" is a
+claim nobody can check and every run reports success.
+
+So an optimization skill names, up front:
+
+1. **The headline metric.** One number, with its unit and how it is measured.
+   "Initial-context tokens, measured by `audit-tokens`" — not "context cost".
+2. **The closing report shape.** Before, after, delta, and the command that
+   produced both. The same command for both readings, or the delta is not a delta.
+
+State what the metric does **not** capture, in one line. An optimization that
+moves the headline number by degrading something it does not measure is the
+failure this pattern exists to make visible, and only the author knows where that
+edge is.
+
+## Contrastive-example slot (optional pattern, authoring and behaviour skills)
+
+Where a skill's guidance is easy to agree with and hard to apply — tone, phrasing,
+question shape, what counts as evidence — a wrong/right pair does what prose
+cannot: it shows the near-miss. Six live corpora already carry them:
+[`direct-answers-demos`](../../../docs/guidelines/agent-infra/direct-answers-demos.md),
+[`asking-and-brevity-examples`](../../../docs/guidelines/agent-infra/asking-and-brevity-examples.md),
+[`language-and-tone-examples`](../../../docs/guidelines/agent-infra/language-and-tone-examples.md),
+and `autonomy-examples` / `interrupt-examples` / `cheap-question-mechanics` under
+`src/agent-src/contexts/execution/`.
+
+Follow one of those rather than inventing a format. The shape they share: the
+**wrong** version first, in the form it actually gets written; the **right**
+version second; and one line of **why** — which is the load-bearing part, because
+a pair without it teaches the specific case and not the rule.
+
+Put the corpus in a guideline or context file and point at it from the skill when
+it outgrows a section. A near-miss corpus is reference material read on demand,
+not always-loaded prose.
+
 ## Do NOT
 
 * Write documentation-style, pointer-only, or too-broad skills ("Laravel skill", "Django skill")

package/dist/agent-src/skills/systematic-debugging/SKILL.md

@@ -222,10 +222,12 @@ right line beats five minutes of IDE breakpoints.
 
 **Known failure signature?** If the symptom has a recognisable shape — a
 tool/agent loop, HTTP 429, `ECONNREFUSED`, `ENOENT`, timeout/hang, OOM, flaky
-test, or works-locally-fails-in-CI — consult the symptom → cause → first-check
+test, works-locally-fails-in-CI, or repeated attempts at a tool that is not
+available — consult the symptom → cause → first-check
 lookup in [`failure-signatures`](../../../docs/guidelines/agent-infra/failure-signatures.md)
-to shortcut Phase 2 (Isolate) with the highest-probability first check. It
-supplements the loop; it does not replace it.
+to shortcut Phase 2 (Isolate) with the highest-probability first check. Each row
+carries a stable id you can cite, and a discrimination drill that produces its
+documented symptom. It supplements the loop; it does not replace it.
 
 ## Condition-based waiting (intermittent bugs)
 

package/dist/agent-src/skills/tailwind-engineer/SKILL.md

@@ -157,8 +157,32 @@ Risks:          <arbitrary values, !important, dark-mode gaps>
 
 When `DESIGN.md` declares `## Taste Dials`, honour them: Variance → layout-family spread + asymmetry tolerance; Motion → animation budget + reduced-motion posture; Density → spacing scale + information-per-viewport. Absent → follow the design brief's inferred dials.
 
+## Security constraints
+
+`scripts/tailwind_config_gen.ts` is the only shipped script.
+
+- **What it may touch** — exactly one file: `--output PATH`, or
+  `tailwind.config.ts` / `.js` in the current working directory when no
+  `--output` is given. It reads nothing from the project.
+- **What it must never do** — write anywhere other than that one path,
+  reach the network, or spawn a subprocess. It does none of these.
+- **Default invocation** — **mutating**, and stated here because it is a
+  real exception rather than a comfortable one: a bare invocation writes
+  `tailwind.config.ts` into `cwd`, overwriting an existing config without
+  prompting. `--validate-only` is the read-only path — it prints the
+  generated config to stdout and writes nothing. Run `--validate-only`
+  first, and pass `--output` when the target is not the cwd default.
+  This default contradicts `skill-writing`'s "never mutate on a bare
+  invocation" line; it is recorded rather than silently tolerated, and
+  changing the script's default is a caller-visible behaviour change that
+  belongs in its own change, not here.
+- **Outbound** — nothing. No network access.
+
 ## Do NOT
 
+- Do NOT run `tailwind_config_gen` bare in a project that already has a
+  `tailwind.config.*` — it overwrites without asking. Use
+  `--validate-only` first, then `--output` at the intended path.
 - Do NOT add `!important` to win a specificity fight; restructure
   the cascade or extract the conflicting style.
 - Do NOT introduce a new colour outside `tailwind.config` without

package/dist/agent-src/skills/testing-anti-patterns/SKILL.md

@@ -163,6 +163,27 @@ expect([403, 404]).toContain((await api.get(`/users/${otherTenantUser.id}`)).sta
 
 Deriving from seeded data is necessary but **not sufficient** — a test that only reads back the exact fields it seeded is still overfit (a mutation in the code survives it). A real test also exercises boundary (empty / null / max / Unicode), error (missing / invalid), and, on security-sensitive paths, an abuse case (IDOR, injection string, XSS payload). Coverage of *cases*, not just lines.
 
+**The adversarial variant, and it is the one that looks safest.** A *negative* test — the abuse case just named — fails the same way, but nothing about it reads as weak: it names an attack, it asserts a refusal, it goes green. It passes because **something other than the control under test** produced that refusal. Two shapes, both from one real review:
+
+- **The hostile value sits only in the argument.** A guard rejecting a path-traversing `token` was pinned by planting a fixture whose own `token` field held the *legitimate* value while `'../outside'` was passed as the argument. Downstream, an ordinary token comparison mismatched and returned exactly the expected refusal — delete the guard and the test still passes. The hostile value belongs in the **field under test**, not only in the call.
+- **The assertion cannot fail.** The same test asserted the planted file still existed after a rejected claim. The two directories were siblings, so both `../x.json` joins resolved to one path and the rename could never have moved it — a green no implementation could turn red.
+
+Gate:
+
+```
+BEFORE trusting a negative test:
+  Delete or invert the control it claims to pin. Does it FAIL?
+  RESTORE THE CONTROL IMMEDIATELY — before any other edit, before any commit.
+    The mutation is a probe, never a change. A deleted guard left deleted is
+    a shipped vulnerability produced by a test-quality check.
+  IF it still passes: it is pinning something else. Name what, then fix the test.
+  IF an assertion cannot fail for ANY implementation: delete THE ASSERTION —
+    it is decoration. Only after proving vacuity, and never to turn a red test
+    green — that is Anti-Pattern 7 below.
+```
+
+No mutation-testing rig required: comment the control out, run that one spec, put it back. A negative test nobody has ever watched fail is a claim, not evidence.
+
 ### Anti-Pattern 7 — Gaming the green (test-integrity)
 
 Symptom: a test fails, and the "fix" edits the *test* instead of the code — `.skip` / `it.skip` / `xfail` / `@Disabled` on the failing case, deleting the failing assertion, loosening `toBe(x)` to `toBeTruthy()`, or rewriting the `expected` value to whatever the (possibly buggy) code now emits. The suite goes green while the behavior stays broken — the worst outcome, because green now *hides* the bug. This is the automation-bias trap: under pressure to finish, the agent optimizes the signal (green) instead of the target (correct behavior).
@@ -211,6 +232,7 @@ This is the test-surface instance of the `autonomous-execution` N=3 / allowlist-
 - Do NOT mark a story complete until at least one test was watched failing first.
 - Do NOT hardcode an expected value the code will emit, or pin a regex to an incidental fixed date/id — derive from inputs and seeded data, and vary the input across cases.
 - Do NOT skip / `xfail` / delete a failing test, or rewrite its `expected` to the code's current output, to get a green run — fix the code, or state a real spec change in the diff.
+- Do NOT trust a negative test you have never watched fail — delete the control it pins, confirm the test goes red, restore the control immediately.
 
 ## Auto-trigger keywords
 
@@ -225,6 +247,9 @@ This is the test-surface instance of the `autonomous-execution` N=3 / allowlist-
 - gaming the green
 - skip failing test
 - test integrity
+- negative test
+- vacuous assertion
+- abuse-case test
 
 ## Provenance
 

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "9.33.0"
+agent_config_version: "9.35.0"
 
 # --- Project identity ---
 project:

package/dist/agent-src/templates/scripts/memory_lookup.ts

@@ -388,8 +388,7 @@ function* _iter_knowledge_entries(): Generator<[string, Record<string, unknown>]
 /**
  * Naive relevance score: max over keys of (glob-match | substring).
  *
- * Good enough for the `absent` path where retrieval is best-effort.
- * The `present` path returns a real score from agent-memory.
+ * Retrieval is best-effort by design — this is the only scoring path.
  */
 export function _score(entry: Record<string, unknown>, keys: string[]): number {
     if (keys.length === 0) {

package/dist/agent-src/templates/scripts/memory_signal.ts

@@ -214,10 +214,8 @@ export interface SignalRecord {
 /**
  * Append a signal entry. Returns the written record, or null when skipped.
  *
- * On `present` backend, routing to the package is a no-op here today —
- * the package adapter is wired in `road-to-agent-memory-integration.md`
- * Phase 3. For now, the file path is the single source of truth so
- * merge-safety is preserved in every mode.
+ * The file path is the single source of truth: there is no external backend
+ * to route to, so merge-safety holds in every mode.
  */
 export function emit(
     entry_type: string,

package/dist/agent-src/templates/scripts/work_engine/hooks/builtin/decision_gate.ts

@@ -41,6 +41,22 @@ type Any = unknown;
 
 const _BLOCK_REASON_PREFIX = 'decision_gate';
 
+/**
+ * Stage an action for confirmation and return the surface lines that name it.
+ *
+ * An injected collaborator rather than a direct import of
+ * `staged_confirmation_store.js`, for two reasons. The gate is called from a
+ * hook bus with no repo root and no clock of its own, and — the load-bearing
+ * one — an absent stager keeps the `ask` path byte-identical to what ships
+ * today. The confirmation primitive is deliberately UNBOUND until blocker
+ * `confirmation-degraded-host-semantics` is decided (5 of 8 hosts have no
+ * `pre_tool_use` slot), so reaching it has to be an explicit opt-in and not a
+ * behaviour change that arrives with an upgrade.
+ */
+export interface ConfirmationStager {
+    stage(input: { action: string; object: string; source: string }): readonly string[];
+}
+
 /**
  * Evaluate decision-engine gates on every `AFTER_STEP`.
  *
@@ -49,9 +65,11 @@ const _BLOCK_REASON_PREFIX = 'decision_gate';
  */
 export class DecisionGateHook {
     private readonly _settings: DecisionEngineSettings;
+    private readonly _stager: ConfirmationStager | null;
 
-    constructor(settings: DecisionEngineSettings) {
+    constructor(settings: DecisionEngineSettings, stager: ConfirmationStager | null = null) {
         this._settings = settings;
+        this._stager = stager;
     }
 
     /** Register the gate callback on `AFTER_STEP`. */
@@ -109,10 +127,22 @@ export class DecisionGateHook {
                 DecisionGateHook._surface(decision, 'ask_timeout'),
             );
         }
-        throw new HookHalt(
-            `${_BLOCK_REASON_PREFIX}:${decision.gate_id}`,
-            DecisionGateHook._surface(decision),
-        );
+        // `stop` and `ask` share this exit: both halt, which is the policy —
+        // ask and action are strictly sequential, so an interactive gate does
+        // not act while it asks. What `ask` adds, and only when a stager is
+        // injected, is a token on the surface so the answer can be matched to
+        // THIS question and consumed exactly once. The halt reason is
+        // deliberately unchanged: it is the identity downstream readers match on.
+        let surface = DecisionGateHook._surface(decision);
+        if (action === 'ask' && this._stager !== null) {
+            const extra = this._stager.stage({
+                action: `work_engine:advance:${decision.gate_id}`,
+                object: `phase ${decision.phase}`,
+                source: _BLOCK_REASON_PREFIX,
+            });
+            surface = [...surface, '', ...extra];
+        }
+        throw new HookHalt(`${_BLOCK_REASON_PREFIX}:${decision.gate_id}`, surface);
     }
 
     // -- formatting helpers -------------------------------------------