@event4u/agent-config 9.6.0 → 9.7.0

package/README.md

@@ -14,7 +14,7 @@
 
 **Every public claim in this README is machine-checked — [verify it yourself](docs/proof.md).** In a market that runs on unbacked headline numbers, this one binds each claim to resolvable evidence or fails its own build.
 
-**A deep library of skills, commands, and governed rules** — plus a capability router that loads the right skill on intent, and multi-agent orchestration with consensus review. The whole layer is compiled into 7+ host agents (Claude Code, Cursor, Augment, Cline, Windsurf, Copilot, Gemini) with **zero runtime daemon**.<!-- claim:no-runtime-daemon --> Six role-shaped entry paths sit on top, so any host becomes a reliable team member — without locking you to a single model or vendor.
+**A deep library of skills, commands and governed rules** — plus a capability router that loads the right skill on intent and multi-agent orchestration with consensus review. The whole layer is compiled into 7+ host agents (Claude Code, Cursor, Augment, Cline, Windsurf, Copilot, Gemini) with **zero runtime daemon**.<!-- claim:no-runtime-daemon --> Six role-shaped entry paths sit on top, so any host becomes a reliable team member — without locking you to a single model or vendor.
 
 ### What's different
 
@@ -27,13 +27,13 @@ It is both deep **and** disciplined — and honest about what it deliberately is
 
 **What it deliberately is *not*** — a content + governance layer, not a runtime: **no background daemon, no separate state database, no self-rewriting memory, no auto-build pipeline.** The host agent runs the loop; every learned change is human-reviewed; the same layer stays portable across tools. Capability without a process to babysit.
 
-> **Where this comes from (honest provenance).** The skills, rules, and personas
+> **Where this comes from (honest provenance).** The skills, rules and personas
 > are distilled from real production work on TypeScript and PHP codebases. The
 > governance mechanics are stack-agnostic, but the domain heuristics are richest
 > where they were forged — treat coverage on other stacks as promising, not
-> proven, and tell us where it falls short.
+> proven and tell us where it falls short.
 
-See exactly [what works on which host](docs/capability-matrix.md), or jump to [things you can do in a minute](docs/cookbook.md).
+See exactly [what works on which host](docs/capability-matrix.md) or jump to [things you can do in a minute](docs/cookbook.md).
 
 ### Pick your profile — six entry paths
 
@@ -100,14 +100,14 @@ is platform operation, not a user-work flow.)
 
 > **Creative Pack — cinematic AI video.** script → character-locked image → motion+audio prompt → provider render → stitched clip, with `AIV_DRYRUN=true` as the cost-safety default. A first-class capability inside the **content / creator** experience — no longer the package's headline. See [`/video:from-script`](.augment/commands/video/from-script.md).
 
-> **Legal Pack — not legal advice.** The EU/DE legal pack (contract/NDA/DPA review, triage) is a **research-and-drafting aid only** — it does not provide legal advice, does not replace a qualified lawyer, and must not be relied on for any concrete matter. It produces general information and general templates, never individual-case examination. Read [`LEGAL_NOTICE.md`](LEGAL_NOTICE.md) before use.
+> **Legal Pack — not legal advice.** The EU/DE legal pack (contract/NDA/DPA review, triage) is a **research-and-drafting aid only** — it does not provide legal advice, does not replace a qualified lawyer and must not be relied on for any concrete matter. It produces general information and general templates, never individual-case examination. Read [`LEGAL_NOTICE.md`](LEGAL_NOTICE.md) before use.
 
 > Full catalog — every skill, rule, command, guideline: [`docs/catalog.md`](docs/catalog.md). The headline is the **experience** (profile + packs) **and** the depth behind it.
 
 ## Use it in your project
 
 Run from a consumer repo — bootstrap via `npx`, the agent picks up
-your stack, and you ship work end-to-end. New install? Start with the
+your stack and you ship work end-to-end. New install? Start with the
 [Quickstart](#quickstart). Already installed? [Supported tools](#supported-tools)
 shows the wired AIs; [`docs/featured-commands.md`](docs/featured-commands.md)
 lists the end-to-end workflows (`/implement-ticket`, `/work`,
@@ -119,8 +119,8 @@ lists the end-to-end workflows (`/implement-ticket`, `/work`,
 
 Don't take the claims on trust — **verify them.** [`docs/proof.md`](docs/proof.md)
 is generated from source: a claim→evidence table (every public claim binds to a
-resolvable pointer, or CI fails), honest-null benchmarks *including the runs where
-the package changed nothing*, and a "verify it yourself" block you run on a fresh
+resolvable pointer or CI fails), honest-null benchmarks *including the runs where
+the package changed nothing* and a "verify it yourself" block you run on a fresh
 checkout. The proof page fails CI if it drifts from its sources — reproducibility
 is the proof. Browse it on the deployed docs site — the proof page is the primary entry:
 [event4u-app.github.io/agent-config/proof/](https://event4u-app.github.io/agent-config/proof/).
@@ -132,7 +132,7 @@ find-replace re-skin PRs here runs on your catalog too —
 [`docs/anti-reskin-gate.md`](docs/anti-reskin-gate.md).
 
 Audit-disciplined by construction — every memory consult, decision
-key, and hook concern lands in `agents/runtime/state/` so you can replay it.
+key and hook concern lands in `agents/runtime/state/` so you can replay it.
 [Core principles](#core-principles) names the four invariants;
 [What `agent-config` is — and what it isn't](#what-agent-config-is--and-what-it-isnt)
 draws the scope boundary.
@@ -207,7 +207,7 @@ Migrating from a v1.x install? `npx @event4u/agent-config migrate` — full note
 
 A **content layer** — skills, rules, commands, guidelines, personas — distributed via npm and projected into every supported AI tool's native config format. It follows the [Agent Skills open standard](https://agentskills.io).
 
-It is **not** an agent runtime. The agent loop, the LLM dispatcher, and tool orchestration stay with the host tool (Claude Code, Augment, Cursor, Cline, Windsurf, Gemini CLI, Copilot). Think of it as a playbook and style guide for those tools — not a replacement.
+It is **not** an agent runtime. The agent loop, the LLM dispatcher and tool orchestration stay with the host tool (Claude Code, Augment, Cursor, Cline, Windsurf, Gemini CLI, Copilot). Think of it as a playbook and style guide for those tools — not a replacement.
 
 | In scope | Out of scope |
 |---|---|
@@ -254,7 +254,7 @@ refine → memory → analyze → plan → implement → test → verify → rep
 - **Reviews** the diff through four judges (bugs, security, tests, code quality).
 - **Reports** changes, verdicts, follow-ups — then stops. `/commit` and `/pr:create` are suggestions, never auto-run.
 
-Any ambiguity halts the flow with numbered options — never a silent guess. Persona comes from `.agent-settings.yml` (`roles.active_role`): `senior-engineer` (default), `qa`, or `advisory` (plan-only).
+Any ambiguity halts the flow with numbered options — never a silent guess. Persona comes from `.agent-settings.yml` (`roles.active_role`): `senior-engineer` (default), `qa` or `advisory` (plan-only).
 
 → [Command reference](dist/agent-src/commands/implement-ticket.md) · [Flow contract](docs/contracts/implement-ticket-flow.md)
 
@@ -316,7 +316,7 @@ Create the user file interactively: `/agents user init` ([schema](docs/contracts
 
 ### Self-hosted MCP on Cloudflare — zero local install
 
-Skills, commands, rules, and guidelines can be served as an MCP endpoint from your own Cloudflare Worker — any MCP client (Claude Desktop, Claude Code, Cursor, Zed, Continue, hosted agents) talks to it over HTTP. Two auth modes: `public` (default, OSS read-only deploys) and `bearer-auth` (operator opt-in, `MCP-Token` Wrangler secret).
+Skills, commands, rules and guidelines can be served as an MCP endpoint from your own Cloudflare Worker — any MCP client (Claude Desktop, Claude Code, Cursor, Zed, Continue, hosted agents) talks to it over HTTP. Two auth modes: `public` (default, OSS read-only deploys) and `bearer-auth` (operator opt-in, `MCP-Token` Wrangler secret).
 
 ```bash
 task mcp:cloud:login         # one-time, opens browser
@@ -340,13 +340,13 @@ task mcp:cloud:secret-put    # opt in to bearer-auth (recommended for private de
 
 The Hard Floor on organization-mode features (SSO, central policy, OAuth connectors, team-context) is preserved by design — they stay cancelled until a real first customer + funded security audit lifts them. The small-team recipe is the supported path in the meantime.
 
-> *The 9.3/10 feedback round (2026-05-25) re-asked for OAuth knowledge connectors, IAM / org governance, and organization-shared memory. Each is a stable cancellation row in [`team-deployment-posture`](docs/deploy/team-deployment-posture.md) under the same three release gates — recruited team customer · funded audit · maintainer ADR.*
+> *The 9.3/10 feedback round (2026-05-25) re-asked for OAuth knowledge connectors, IAM / org governance and organization-shared memory. Each is a stable cancellation row in [`team-deployment-posture`](docs/deploy/team-deployment-posture.md) under the same three release gates — recruited team customer · funded audit · maintainer ADR.*
 
 ---
 
 ## Harness expectations
 
-Three classes of install/runtime behaviour look like package bugs but are host-harness behaviour the package cannot control — sibling-plugin namespaces (`codex:*`, `cc-gemini-plugin:*`), deferred tools surfaced via `ToolSearch`, and cross-scope skill drift (real bug, fixed in the distribution-channels track). Diagnostics + the package's response: [`docs/contracts/harness-expectations.md`](docs/contracts/harness-expectations.md). First step when a skill appears twice: `task probe:skills`.
+Three classes of install/runtime behaviour look like package bugs but are host-harness behaviour the package cannot control — sibling-plugin namespaces (`codex:*`, `cc-gemini-plugin:*`), deferred tools surfaced via `ToolSearch` and cross-scope skill drift (real bug, fixed in the distribution-channels track). Diagnostics + the package's response: [`docs/contracts/harness-expectations.md`](docs/contracts/harness-expectations.md). First step when a skill appears twice: `task probe:skills`.
 
 ## Supported tools
 
@@ -477,7 +477,7 @@ Browse content: [all commands](dist/agent-src/commands/) · [skills catalog](doc
 ## Troubleshooting
 
 First stop for any install problem: `agent-config doctor` — it flags a
-missing-from-`PATH` binary, binary↔plugin version drift, stale orphans, and
+missing-from-`PATH` binary, binary↔plugin version drift, stale orphans and
 manifest issues, each with a one-line fix hint.
 
 ### A new command / skill is missing in Claude Code after an upgrade
@@ -486,7 +486,7 @@ Under the single-surface model, `agent-config upgrade` refreshes the
 `~/.claude/` file projection — that IS the content surface, so a fresh
 session picks the new commands up directly. If commands are still missing,
 the usual cause is a leftover **marketplace plugin**: it is a git-SHA
-snapshot that never moves with the npm upgrade, and it shadows nothing —
+snapshot that never moves with the npm upgrade and it shadows nothing —
 it just lists everything twice while lagging behind. Remove it:
 
 ```bash
@@ -521,7 +521,7 @@ Only the initial `npm install -g` hard-aborts an upgrade. Every later step
 (global re-deploy with hook registration, settings sync, wrapper + git-hook
 refresh) runs independently — a single failed step is reported in the
 end-of-run summary instead of silently skipping the rest. Re-run
-`agent-config upgrade` to converge, and use `agent-config doctor` to name
+`agent-config upgrade` to converge and use `agent-config doctor` to name
 anything left in a mixed state.
 
 ### `agent-config: command not found` / hooks stopped firing

package/dist/agent-src/README.md

@@ -1,8 +1,8 @@
 # Agent Infrastructure
 
 > **⚠️ DO NOT edit files in `dist/agent-src/` or `.augment/` directly.**
-> The source of truth is `.agent-src.uncondensed/`. Edit there, then run `task sync`.
-> See `.agent-src.uncondensed/commands/condense.md` for the full workflow.
+> The source of truth is `src/` (`src/skills/`, `src/rules/`, `src/agent-src/`). Edit there, then run `task sync`.
+> See the `source-of-truth` rule and the `/condense` command for the full workflow.
 
 This directory contains the shared agent infrastructure: skills, commands, rules, guidelines,
 templates, and contexts that power the AI coding assistant across all projects.

package/dist/agent-src/rules/downstream-changes.md

@@ -45,7 +45,36 @@ After editing any file, search for **all** of these:
 | **Config / bindings** | Search service providers, config files | Update class references in DI bindings |
 | **API schemas / OpenAPI** | Check controller attributes | Update if response structure changed |
 | **Routes** | Search `routes/` for controller references | Update after controller rename/move |
-| **Documentation** | Search `agents/`, `docs/` for references | Update if behavior or API changed |
+| **Documentation** | Search `agents/`, `docs/`, `README`, examples for references | Update the doc that **describes** the changed surface — see Doc-Impact below |
+
+## Doc-Impact — docs follow code (same change)
+
+```
+A CHANGE TO A PUBLIC SURFACE IS INCOMPLETE UNTIL THE DOC THAT
+DESCRIBES IT IS UPDATED IN THE SAME CHANGE. A DOC MAKING A CLAIM
+THE CODE NOW CONTRADICTS IS A BROKEN CHANGE, NOT A STYLE NIT.
+```
+
+**Public surfaces** whose change triggers a doc update: HTTP route /
+endpoint · exported function / class signature · CLI command or flag ·
+config / settings key · env var · DB schema or migration · event
+payload. Update the doc that describes it — README, API / OpenAPI docs,
+AGENTS.md, code examples, CHANGELOG — in the same commit.
+
+**Drift = a falsifiable-claim contradiction**, not incompleteness. Fire
+when a reader following the doc would be misled: an endpoint that no
+longer exists, a wrong return type, a renamed key, a broken example. Do
+**not** fire on "the doc could be more detailed" — completeness is a
+quality nit, not drift.
+
+**Escape hatch** (no false-positive fatigue): refactor-only / no
+public-surface change → no doc obligation. If a surface changed but
+genuinely needs no doc edit, state the one-line reason instead of
+editing a doc to satisfy the rule.
+
+Detection + the framework-agnostic surface→doc map (Laravel / Symfony /
+Next.js / Python / Go) live in [`agent-docs-writing`](../skills/agent-docs-writing/SKILL.md)
+§ Doc-Impact — run it after every code change.
 
 ## Breaking changes
 
@@ -78,3 +107,4 @@ After completing all downstream changes:
 3. **No broken types / signatures** — project's type-checker (PHPStan / Psalm, TypeScript, mypy / pyright, `go vet`, `cargo check`).
 4. **No stale references** — grep for the old name / namespace / import path to confirm zero results.
 5. **No own-orphans** — the same sweep applied to the new diff: identifiers whose last reference disappeared in a file this diff touched are removed in the same diff (see [`minimal-safe-diff § Own-orphan cleanup`](minimal-safe-diff.md#own-orphan-cleanup)); pre-existing dead code stays.
+6. **No doc drift** — a public surface changed this diff has its describing doc updated (or the one-line no-doc-needed reason stated), per Doc-Impact above.

package/dist/agent-src/skills/agent-docs-writing/SKILL.md

@@ -189,29 +189,47 @@ After making changes, check if docs need updating:
 - **Structural changes** → update affected docs in `./agents/`
 - **New patterns** → update or create guideline docs
 
-## Doc sync check (after code changes)
+## Doc-Impact — the mandatory check after every code change
 
-After completing a significant code change, run this mental checklist:
+This is the detection procedure the [`downstream-changes`](../../rules/downstream-changes.md)
+§ Doc-Impact obligation points at. **Run it after every code change** — the
+*detection* is non-optional; the human still confirms the actual edit.
 
-| What changed | Doc to check |
+**Step 1 — did a public surface change?** Framework-agnostic surface list:
+
+| Public surface changed | Doc that describes it — update in the same change |
 |---|---|
-| Database schema (migration) | `agents/reference/docs/database-setup.md` |
-| New API endpoint | OpenAPI annotations, `AGENTS.md` API section |
-| New module created | Create `{module_root}/{Module}/{agent_folder}/` (resolve via `modules.root_paths` + `modules.agent_folder`) |
-| Service/repository signature changed | Check if referenced in `agents/reference/docs/services-and-repos.md` |
-| New environment variable | `.env.example`, `AGENTS.md` environment section |
-| Docker/compose change | `agents/reference/docs/docker.md`, `Makefile` documentation |
-| New Artisan command | `AGENTS.md` commands section |
-| New pattern/convention introduced | Relevant guideline in `.augment/guidelines/` |
-
-**When unsure** — ask with numbered options:
+| HTTP route / endpoint (Laravel `routes/`, Next.js `app/api`, FastAPI/Express handlers, Go mux) | OpenAPI / API reference, `README` usage, `AGENTS.md` API section |
+| Exported function / class / method signature | The doc/example that calls it; `agents/reference/docs/services-and-repos.md` if referenced |
+| CLI command or flag | `README` usage, `AGENTS.md` commands section, `--help` text |
+| Config / settings key | Settings doc, `README` config section, schema/example file |
+| Environment variable | `.env.example`, `AGENTS.md` environment section |
+| DB schema / migration | `agents/reference/docs/database-setup.md` |
+| Event payload / job constructor | The listener/consumer doc that documents the contract |
+| New module | `{module_root}/{Module}/{agent_folder}/` (resolve via `modules.root_paths` + `modules.agent_folder`) |
+| New pattern / convention | Relevant guideline in `.augment/guidelines/` |
+| Architectural decision | [`adr-create`](../adr-create/SKILL.md) — numbered ADR + index regen |
+
+**Step 2 — apply the fire/no-fire test.** Drift is a **falsifiable-claim
+contradiction**, not incompleteness:
+
+- **FIRE** (doc is now wrong — a reader would be misled): endpoint no longer
+  exists, wrong return type, renamed key, removed flag, broken code example.
+- **DO NOT FIRE** (completeness / quality only): the doc is high-level and
+  omits a new internal detail it never claimed to list; "could be clearer".
+
+**Step 3 — escape hatch.** Refactor-only / no public-surface change → no doc
+obligation. Surface changed but genuinely needs no doc edit → state the
+one-line reason; never edit a doc just to satisfy the rule (false-positive
+fatigue is worse than a missed nit).
+
+**When a doc edit IS needed but you are unsure of the wording** — flag it with
+numbered options; do NOT auto-rewrite prose without the user's knowledge:
 ```
 > 1. Yes — update the docs
-> 2. No — leave as-is
+> 2. No — leave as-is (reason: …)
 ```
 
-Do NOT auto-update docs without the user's knowledge. Flag what needs updating and let the user decide.
-
 ## Rules
 
 - All `.md` files must be in **English**.

package/dist/agent-src/skills/agents-md-thin-root/SKILL.md

@@ -21,7 +21,7 @@ packs:
 
 Use when:
 - Editing `AGENTS.md` at the package root.
-- Editing `packages/core/.agent-src.uncondensed/templates/AGENTS.md` (consumer-shipped template).
+- Editing `src/agent-src/templates/AGENTS.md` (consumer-shipped template).
 - Reviewing a PR that changes either file.
 - Running `/optimize/agents`.
 - A budget meter (`scripts/measure_augment_budget.ts`) flags the package-root AGENTS.md as the dominant cost.
@@ -29,7 +29,7 @@ Use when:
 ## Do NOT
 
 - Edit `.github/copilot-instructions.md` with this skill (use `copilot-agents-optimization` instead).
-- Edit other `.md` files under `.augment/`, `packages/*/.agent-src.uncondensed/`, or `agents/` with this skill.
+- Edit other `.md` files under `.augment/`, `src/`, or `agents/` with this skill.
 - Add a section to AGENTS.md without first checking whether an outboard target already exists in `agents/settings/contexts/` or `docs/contracts/`.
 - Replace prose with a bare link `[label](path)` — every pointer needs a *why*-clause ≥ 60 chars or it does not count toward the 40 % ratio.
 - Reuse the package-root anatomy in the consumer template — caps and target paths differ.
@@ -47,7 +47,7 @@ Every entry describes **what** the project does or **where** to learn more — n
 | File | FAIL above | WARN above | Target |
 |---|---|---|---|
 | `AGENTS.md` (package root) | 3,000 chars | 2,800 chars | ≤ 2,800 |
-| `packages/core/.agent-src.uncondensed/templates/AGENTS.md` (consumer) | 2,500 chars | 2,300 chars | ≤ 2,300 |
+| `src/agent-src/templates/AGENTS.md` (consumer) | 2,500 chars | 2,300 chars | ≤ 2,300 |
 
 Char-count is raw file size (`wc -c`), frontmatter included. Enforcement: `scripts/lint_agents_md.ts` (Phase 7), wired into the package's CI pipeline via the `lint-agents-md` task. WARN is a soft signal in CI; FAIL blocks merge.
 
@@ -85,7 +85,7 @@ Every substantive pointer specifies, on the same line or the immediately followi
 
 ## The contract — emergency-triage block
 
-Every Thin-Root AGENTS.md MUST contain an **Emergency Triage** section verbatim from `packages/core/.agent-src.uncondensed/contexts/contracts/emergency-triage-block.md` (Phase 6.4 will create that file as the canonical source). The block lists the five questions a host agent answers from the root file alone when network / tool access is degraded:
+Every Thin-Root AGENTS.md MUST contain an **Emergency Triage** section verbatim from `src/agent-src/contexts/contracts/emergency-triage-block.md` (Phase 6.4 will create that file as the canonical source). The block lists the five questions a host agent answers from the root file alone when network / tool access is degraded:
 
 1. What is this repository?
 2. What language(s) does this repository accept?
@@ -99,22 +99,22 @@ Each answer must fit on one line. The block exists so the root never silently de
 
 1. **Measure baseline.** `wc -c AGENTS.md` and `./scripts-run src/scripts/measure_augment_budget`. Record current char-count and the gap to 2,200 / 2,500.
 2. **Inventory sections.** List every `## ` heading and its char-count. Mark each as `keep-inline` (Iron-Law-adjacent, ≤ 200 chars, no good outboard target) or `outboard-candidate` (longer-form prose, table-only sections, narrative).
-3. **Identify outboard targets.** For each `outboard-candidate`, name the destination — `packages/core/.agent-src.uncondensed/contexts/`, `docs/contracts/`, an existing rule body, an existing skill body. Never invent a new top-level directory.
+3. **Identify outboard targets.** For each `outboard-candidate`, name the destination — `src/agent-src/contexts/`, `docs/contracts/`, an existing rule body, an existing skill body. Never invent a new top-level directory.
 4. **Move content; insert pointer.** Cut the section into the target file. Replace it in AGENTS.md with a single substantive pointer per anatomy above. Verify the *why*-clause length.
 5. **Re-measure.** `wc -c AGENTS.md` again. If above 2,200, repeat steps 2–4 on the next-largest section. Above 2,500 = must outboard further before commit.
 6. **Validate pointer ratio.** Count non-blank lines and substantive-pointer lines. Ratio < 0.40 = collapse decorative or boilerplate lines into a single pointer or remove.
-7. **Verify emergency-triage block.** Diff the in-file block against `packages/core/.agent-src.uncondensed/contexts/contracts/emergency-triage-block.md`. Drift = revert to canonical.
+7. **Verify emergency-triage block.** Diff the in-file block against `src/agent-src/contexts/contracts/emergency-triage-block.md`. Drift = revert to canonical.
 8. **Run lints.** `task lint-agents-md && task check-refs && task lint-skills`. All green before commit.
 
 ## Procedure — apply Thin-Root to consumer template
 
-Same procedure, applied to `packages/core/.agent-src.uncondensed/templates/AGENTS.md`. Hard cap shifts to 2,000 / 1,700. The consumer template intentionally lacks the package-self-references — its pointers target files that exist in the **consumer's** repo (`.augment/skills/`, `agents/settings/contexts/`, ...), not this package's authoring tree.
+Same procedure, applied to `src/agent-src/templates/AGENTS.md`. Hard cap shifts to 2,000 / 1,700. The consumer template intentionally lacks the package-self-references — its pointers target files that exist in the **consumer's** repo (`.augment/skills/`, `agents/settings/contexts/`, ...), not this package's authoring tree.
 
 ## Gotchas
 
-- **Outboarding to a new top-level dir.** Inventing `agents/explainers/` or `docs/notes/` for the moved content silently widens the contract surface. Outboard only into `packages/core/.agent-src.uncondensed/contexts/`, `docs/contracts/`, an existing rule body, or an existing skill body.
+- **Outboarding to a new top-level dir.** Inventing `agents/explainers/` or `docs/notes/` for the moved content silently widens the contract surface. Outboard only into `src/agent-src/contexts/`, `docs/contracts/`, an existing rule body, or an existing skill body.
 - **Pointer-ratio inflation by decoration.** Adding boilerplate "Browse all skills" / "See also" links to lift the ratio above 40 % defeats the purpose. The lint counts only substantive pointers (with a *why*-clause ≥ 60 chars); decorative links get filtered out and the ratio drops back below threshold.
-- **Emergency-triage drift.** Editing the in-file emergency-triage block instead of the canonical `packages/core/.agent-src.uncondensed/contexts/contracts/emergency-triage-block.md` causes the package-root and consumer-template versions to diverge silently. Always edit the canonical file and let the lint diff pull both back in sync.
+- **Emergency-triage drift.** Editing the in-file emergency-triage block instead of the canonical `src/agent-src/contexts/contracts/emergency-triage-block.md` causes the package-root and consumer-template versions to diverge silently. Always edit the canonical file and let the lint diff pull both back in sync.
 - **Cap inversion under WARN.** A 2,250-char AGENTS.md (above 2,200 WARN, below 2,500 FAIL) is a yellow signal not a green one — every additional sentence raises the probability of the next FAIL. Treat WARN as the spend boundary, not a buffer.
 - **Char-count includes frontmatter.** `wc -c` counts every byte including the YAML preamble, blank lines, and the trailing newline. Stripping a section to "look smaller" without re-running `wc -c` understates the true budget impact.
 - **Path enumeration.** A run of three or more bare `` `path/to/dir/` `` bullets without *why*-clauses is the classic re-bloat pattern. The lint emits a WARN at ≥ 3 such lines. Collapse them into one capability-style pointer — see the recipe in [`agents-md-anatomy § Iron Law`](../../contexts/contracts/agents-md-anatomy.md#iron-law--capabilities-over-structure).

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "9.6.0"
+agent_config_version: "9.7.0"
 
 # --- Project identity ---
 project:

package/dist/agent-src/templates/github-workflows/doc-impact.yml

@@ -0,0 +1,101 @@
+# Doc-Impact Check — template shipped by agent-config
+#
+# Copy this file to `.github/workflows/doc-impact.yml` in the consumer
+# project. It is the OPTIONAL CI backstop for the doc-follows-code
+# discipline that already ships to you via projection:
+#
+#   - rule  `downstream-changes` § Doc-Impact  — the same-change obligation
+#   - skill `agent-docs-writing`  § Doc-Impact  — the surface→doc procedure
+#
+# Those two are framework-agnostic and behavioral; they need no CI. This
+# workflow adds a deterministic reminder: when a PR changes a PUBLIC
+# SURFACE but touches no documentation, it flags the likely doc drift.
+#
+# Design (per the 2026-07-21 council): WARN-first, opt-in, with an
+# explicit escape hatch — a gate that hard-fails on every surface change
+# gets routinely overridden, which is worse than none. Flip STRICT=true
+# below only once your team wants the hard gate.
+#
+# Framework-agnostic: it globs the changed-file paths, so it works for
+# Laravel / Symfony / Next.js / Python / Go / … without per-stack tuning.
+# Tune the PUBLIC_SURFACE / DOC globs to your repo layout.
+#
+# Escape hatch: put `[docs:not-needed]` in the PR title/body, or use a
+# `refactor:`-prefixed PR title, when a surface changed but genuinely
+# needs no doc edit. State the reason — do not edit a doc just to pass.
+
+name: Doc-Impact Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  doc-impact:
+    name: Public surface changed without a doc update?
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Detect surface-vs-doc drift
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+          # Flip to "true" to make the drift a hard CI failure.
+          STRICT: "false"
+        run: |
+          set -euo pipefail
+
+          # Escape hatch — skip entirely on an explicit opt-out.
+          case "${PR_TITLE}${PR_BODY}" in
+            *"[docs:not-needed]"*|refactor:*|"refactor("*)
+              echo "Doc-Impact: escape hatch present — skipping." ; exit 0 ;;
+          esac
+
+          changed="$(git diff --name-only "${BASE_SHA}" "${HEAD_SHA}")"
+          echo "Changed files:"; echo "${changed}" | sed 's/^/  /'
+
+          # PUBLIC-SURFACE globs (extend for your stack).
+          surface="$(printf '%s\n' "${changed}" | grep -E \
+            -e '(^|/)routes/' \
+            -e '(^|/)(migrations|schema)/' \
+            -e 'openapi.*\.(ya?ml|json)$' \
+            -e '(^|/)(cli|commands|console)/' \
+            -e '(^|/)\.env\.example$' \
+            -e '(^|/)(config)/' \
+            || true)"
+
+          # DOC globs — a change to any of these satisfies the obligation.
+          docs="$(printf '%s\n' "${changed}" | grep -E \
+            -e '\.md$' \
+            -e '(^|/)docs/' \
+            -e '(^|/)AGENTS\.md$' \
+            -e 'openapi.*\.(ya?ml|json)$' \
+            -e '(^|/)CHANGELOG' \
+            || true)"
+
+          if [ -n "${surface}" ] && [ -z "${docs}" ]; then
+            echo "Public surface(s) changed with NO accompanying doc update:"
+            echo "${surface}" | sed 's/^/  /'
+            echo ""
+            echo "Update the doc that DESCRIBES the changed surface (README /"
+            echo "API reference / AGENTS.md / examples / CHANGELOG), per the"
+            echo "downstream-changes § Doc-Impact obligation. If no doc is"
+            echo "needed, add [docs:not-needed] to the PR with a one-line reason."
+            if [ "${STRICT}" = "true" ]; then
+              echo "::error::Doc-Impact drift (STRICT mode)."
+              exit 1
+            fi
+            echo "::warning::Public surface changed without a doc update — review Doc-Impact."
+            exit 0
+          fi
+
+          echo "Doc-Impact: OK — no undocumented public-surface change."

package/dist/discovery/deprecation-report.md

@@ -1,6 +1,6 @@
 # Discovery — Deprecation Report
 
-- Generated: `2026-07-20T21:31:59Z`
+- Generated: `2026-07-21T09:23:42Z`
 - Deprecated artefacts: **0**
 
 _None. Tree is clean._

package/dist/discovery/discovery-manifest.json

@@ -5974,7 +5974,7 @@
     },
     {
       "category": "rule",
-      "checksum": "sha256:334e9b4b83d0115c3c557c3a0f975f6c3340cb394e45646635e9388e11647e6c",
+      "checksum": "sha256:675ea3203cc4291eedd6ed8633170d176d6d8d6748bc167c8418942981fb5ea9",
       "install": {
         "default": true,
         "removable": false
@@ -7730,7 +7730,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:88c6ff8281b0ee68b5d6d9402bd4b39087f7fb05e5ad92957fd24a63ee0f4032",
+      "checksum": "sha256:f5633f6e11b8336ea668d9c05dc389d5aac66fc544ed5707245d33c8ea083b5d",
       "install": {
         "default": true,
         "removable": false
@@ -7774,7 +7774,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:7d9196f749ea8c8ed0b06e0a8e8985681dc9c43399ec74676397f1baedffc608",
+      "checksum": "sha256:3a690e9739c19360d5b479639fd939aba8aaebcb575d0d56bab55610035bb289",
       "install": {
         "default": true,
         "removable": false
@@ -13781,7 +13781,7 @@
       "workspaces": []
     }
   ],
-  "checksum": "sha256:5d153d76966c915aef5ae07b2d82aee0f7f456e65aef5528ebfe6e3355445769",
+  "checksum": "sha256:6a0dbe5b578ca854a9aec57c2a8a135d1aee10247a5f58f32be93f18e750f302",
   "deprecations": [
     {
       "key": "tier",
@@ -13924,7 +13924,7 @@
       "reason": "scaffold template for ticket-bundle tickets (ADR-101); carries no runtime frontmatter — emit-tickets fills it in per ticket"
     }
   ],
-  "generated_at": "2026-07-20T21:31:59Z",
+  "generated_at": "2026-07-21T09:23:42Z",
   "packs": [
     {
       "artefact_count": 109,

package/dist/discovery/discovery-manifest.json.sha256

@@ -1 +1 @@
-225524bcfd872e6503022848fee38c77b6aa3553443fdb0656c447117cc476d1  discovery-manifest.json
+71417b492c4da8085eb47d0a1edd2c5e00247512b75834b5544409b9a3868415  discovery-manifest.json

package/dist/discovery/discovery-manifest.summary.md

@@ -1,6 +1,6 @@
 # Discovery Manifest — Summary
 
-- Generated: `2026-07-20T21:31:59Z`
+- Generated: `2026-07-21T09:23:42Z`
 - Scanner: `c24312e116f8`
 - Artefacts: **575**
 - Unassigned: **0**

package/dist/discovery/orphan-report.md

@@ -1,6 +1,6 @@
 # Discovery — Orphan Report
 
-- Generated: `2026-07-20T21:31:59Z`
+- Generated: `2026-07-21T09:23:42Z`
 - Orphan artefacts: **0**
 
 > An orphan is an artefact whose declared pack has no other members.

package/dist/discovery/packs.json

@@ -1,6 +1,6 @@
 {
-  "checksum": "sha256:5d153d76966c915aef5ae07b2d82aee0f7f456e65aef5528ebfe6e3355445769",
-  "generated_at": "2026-07-20T21:31:59Z",
+  "checksum": "sha256:6a0dbe5b578ca854a9aec57c2a8a135d1aee10247a5f58f32be93f18e750f302",
+  "generated_at": "2026-07-21T09:23:42Z",
   "packs": [
     {
       "always_on": false,

package/dist/discovery/trust-report.md

@@ -1,6 +1,6 @@
 # Discovery — Trust Report
 
-- Generated: `2026-07-20T21:31:59Z`
+- Generated: `2026-07-21T09:23:42Z`
 - Workspaces tracked: **10**
 - Human-review-required artefacts: **3**
 

package/dist/discovery/workspaces.json

@@ -1,6 +1,6 @@
 {
-  "checksum": "sha256:5d153d76966c915aef5ae07b2d82aee0f7f456e65aef5528ebfe6e3355445769",
-  "generated_at": "2026-07-20T21:31:59Z",
+  "checksum": "sha256:6a0dbe5b578ca854a9aec57c2a8a135d1aee10247a5f58f32be93f18e750f302",
+  "generated_at": "2026-07-21T09:23:42Z",
   "scanner_version": "c24312e116f8",
   "workspaces": [
     {

package/dist/mcp/awesome-mcp-servers.row.md

@@ -1 +1 @@
-| [@event4u/agent-config](https://event4u-app.github.io/agent-config) | Universal AI Agent OS — audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot). | 20 tools (stdio, worker) | `pip install agent-config[mcp] && ./agent-config mcp:run` |
+| [@event4u/agent-config](https://event4u-app.github.io/agent-config) | Universal AI Agent OS — audited skills, governance rules, commands and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot). | 20 tools (stdio, worker) | `pip install agent-config[mcp] && ./agent-config mcp:run` |

package/dist/mcp/mcp-cloudflare-catalogue.json

@@ -1,5 +1,5 @@
 {
-  "description": "Universal AI Agent OS \u2014 audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
+  "description": "Universal AI Agent OS \u2014 audited skills, governance rules, commands and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
   "homepage": "https://event4u-app.github.io/agent-config",
   "install_hint_stdio": "pip install agent-config[mcp] && ./agent-config mcp:run",
   "name": "agent-config-mcp",

package/dist/mcp/registry-manifest.json

@@ -3,13 +3,13 @@
     "artefact_count": 575,
     "scanner_version": "c24312e116f8"
   },
-  "generated_at": "2026-07-20",
+  "generated_at": "2026-07-21",
   "package": {
-    "description": "Universal AI Agent OS \u2014 audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
+    "description": "Universal AI Agent OS \u2014 audited skills, governance rules, commands and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
     "homepage": "https://event4u-app.github.io/agent-config",
     "name": "@event4u/agent-config",
     "repository": "https://github.com/event4u-app/agent-config",
-    "version": "9.6.0"
+    "version": "9.7.0"
   },
   "registries": [
     {

package/docs/CLAIMS.md

@@ -257,4 +257,5 @@ visible, not hidden.
 - kind: quant
 - evidence: docs/benchmark.md#adversarial-verification-council
 - status: unbacked
-- last_verified:
+- last_verified: 2026-07-21
+- resolution: HONEST-NULL (resolved, not pending). Registered cross-vendor run 2026-07-21 on the curated judge-survivable corpus (internal/bench/adversarial-council/): on the judge-passed residual, the 2-vendor skeptic panel (anthropic+openai) matched the single skeptic exactly (residual recall 0.6 = 0.6, zero lift — the second vendor's residual catches were a strict subset of the first), at a 100% false-positive rate on the controversial-but-correct controls under the adversarial-skeptic posture. Both recall thresholds missed → honest-null → Mode 9 surface stays default-off permanently (like recursive-verification). Reproducible artifact: internal/bench/adversarial-council/runs/. Note: an initial run via `council_cli run` was REJECTED as a measurement artifact (that transport imposes multi-round peer-review + prose output, defeating the independent-skeptic + JSON-scoring protocol) — the valid run uses direct independent per-vendor client calls.