@event4u/agent-config 9.6.0 → 9.8.0

package/dist/ui/index.html

@@ -8,17 +8,26 @@
         <script>
             // Theme boot — set data-theme BEFORE first paint so there is no
             // flash of the wrong theme (road-to-setup-experience § Phase 4.2).
-            // Persisted override in localStorage wins; otherwise follow the OS.
+            // Precedence: a host-supplied `?theme=light|dark` boot query wins
+            // (reciprocal-ecosystem embed contract — the host owns the theme),
+            // then a persisted localStorage override, then the OS preference.
             (function () {
+                var query = null;
+                try {
+                    var q = new URLSearchParams(window.location.search).get('theme');
+                    if (q === 'light' || q === 'dark') query = q;
+                } catch (e) { /* older engine */ }
                 var stored = null;
                 try { stored = localStorage.getItem('agent-config-theme'); } catch (e) { /* private mode */ }
-                var theme = stored === 'light' || stored === 'dark'
-                    ? stored
-                    : (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light');
+                var theme = query
+                    ? query
+                    : stored === 'light' || stored === 'dark'
+                        ? stored
+                        : (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light');
                 document.documentElement.setAttribute('data-theme', theme);
             })();
         </script>
-      <script type="module" crossorigin src="/assets/index-BiEZiZ31.js"></script>
+      <script type="module" crossorigin src="/assets/index-CrmZ34Rg.js"></script>
       <link rel="stylesheet" crossorigin href="/assets/index-BPFMZWUs.css">
     </head>
     <body>

package/docs/CLAIMS.md

@@ -32,11 +32,36 @@
 - last_verified: <YYYY-MM-DD>
 ```
 
-**Evidence-pointer grammar (v1):**
+**Evidence-pointer grammar (v2):**
 
 - `path/to/file.md` or `path/to/file.md:42` — the repo file exists (line advisory).
 - `path/to/file.md#substring` — the file exists AND contains `substring`.
 - `https://… (YYYY-MM-DD)` — external cite carrying a dated stamp (not fetched in CI).
+- `exec:<command> -> <exit-code>` — the command **re-runs** and its exit code
+  must match. The only form that can tell a live claim from a stale one.
+
+**Why the fourth form exists.** The first three are existence checks. A claim
+reading "the suite is green" whose pointer resolves to a report nobody
+regenerated stays `backed` indefinitely — the pointer resolves, the claim is
+false. `exec:` re-derives the claim and lets the exit code carry the verdict.
+
+**Where `exec:` runs, and where it does not.** Re-execution happens in CI only.
+Locally the gate is read-only and reports `UNVERIFIED — re-execution is CI-only,
+skipped locally`; it never runs a command in a consumer's checkout. The static
+half — is the pointer well-formed, is the command allowlisted — is checked
+everywhere, because a bad pointer is a defect in the ledger rather than a
+property of the machine.
+
+**What `exec:` cannot cover.** Only claims whose exit code *is* the verdict. A
+figure resting on a paid model run, a stochastic benchmark, or a prose contract
+cannot use this form; those stay on a pointer and are listed as
+unfalsifiable-by-machine in [`proof.md`](proof.md) rather than quietly omitted.
+
+The allowlist is a set of argv prefix tuples in
+[`src/scripts/_lib/exec_evidence.ts`](../src/scripts/_lib/exec_evidence.ts) —
+never a regex over a command string, because a regex over shell text is the
+classic bypass. Every argument after the matched prefix is re-checked for shell
+metacharacters and repo escape, including the right-hand side of `--flag=value`.
 
 ---
 
@@ -52,7 +77,7 @@
 ### claim: shipped-artifacts-hidden-instruction-scanned
 - claim: Every artifact the package ships — source AND the condensed projection that reaches consumers — is machine-scanned in CI for hidden-Unicode, mixed-script-confusable, and instruction-smuggling payloads (the rules-file-backdoor class); a finding blocks the release before `npm publish`, not just the merge.
 - kind: qual
-- evidence: .github/workflows/publish-npm.yml#lint_agent_security
+- evidence: exec:lint_agent_security -> 0
 - status: backed
 - last_verified: 2026-07-09
 
@@ -87,21 +112,21 @@
 ### claim: eval-coverage-ratcheted
 - claim: Behavioural-eval coverage is measured per tier and CI-ratcheted so it can only rise; the current coverage and its gap are published, never implied as "264 evaluated skills".
 - kind: qual
-- evidence: src/scripts/skill_eval_coverage.ts#checkRatchet
+- evidence: exec:skill_eval_coverage --check -> 0
 - status: backed
 - last_verified: 2026-07-08
 
 ### claim: domain-soundness-scoped
 - claim: The non-coding domain skills (finance/founder/ops/content) are forged on TS/PHP and labeled unvalidated until they pass a sourced domain-truth fixture; no public prose implies proven domain correctness, and the validated count is CI-ratcheted.
 - kind: qual
-- evidence: src/scripts/domain_soundness_status.ts#checkRatchet
+- evidence: exec:domain_soundness_status --check -> 0
 - status: backed
 - last_verified: 2026-07-08
 
 ### claim: domain-soundness-validated-count
 - claim: The validated non-coding domain-skill count is pinned and CI-ratcheted at a maintainer-set floor (9 of 20 default-surface skills carry a sourced `evals/domain-truth.json` fixture at pin time, 2026-07-11 — 5 deterministic, keys from cited formulas; 4 rubric, criteria matching a named external practice); the floor only rises via a maintainer `--write-floor` after a new sourced fixture lands.
 - kind: quant
-- evidence: internal/evals/domain-soundness-floor.json#validated
+- evidence: exec:domain_soundness_status -> 0
 - status: backed
 - last_verified: 2026-07-11
 
@@ -119,17 +144,10 @@
 - status: backed
 - last_verified: 2026-07-09
 
-### claim: second-brain-retrieval-precision
-- claim: Removing the perfect-retrieval assumption, the substrate's REAL keyword retrieval recalls the needed decision into the top-5 under keyword-overlapping confusers (precision@5 9/9) and the model disambiguates it from the co-injected confusers — retrieval-on 27/27 vs no-memory 5/27 and vs equal-count placebo 5/27 (claude-haiku-4-5, 9 tasks x 3 seeds, sign test p=0.008 both). Named limit: retrieval RECALLS but does not RANK (mean tie-set 3.3, ties broken by store order, not relevance) — the discrimination gap that motivates the SQLite-FTS5 activation path (ADR-116) at larger scale.
-- kind: quant
-- evidence: internal/bench/reports/second-brain-retrieval.json
-- status: backed
-- last_verified: 2026-07-09
-
 ### claim: lexical-ranking-lift
-- claim: A hand-rolled, dependency-free BM25 + trigram lexical index resolves the "recalls but does not rank" gap: on the retrieval-precision corpus (9 keyword-overlapping-confuser tasks) it drives the mean top tie-set from 3.333 (the `_score` bucket scorer) to 1.0 — every needed decision uniquely top-ranked — with precision@1 and precision@5 unchanged at 1.0. Method: deterministic, model-free re-ranking of the SAME retrieved entry set; both scorers measured over the identical store via `measure_lexical_ranking.ts`.
+- claim: A hand-rolled, dependency-free BM25 + trigram lexical index resolves the "recalls but does not rank" gap: on the retrieval-precision corpus (9 keyword-overlapping-confuser tasks) it drives the mean top tie-set from 3.333 (the `_score` bucket scorer) to 1.0 — every needed decision uniquely top-ranked — with precision@1 and precision@5 unchanged at 1.0. Method: deterministic, model-free re-ranking of the SAME retrieved entry set; both scorers measured over the identical store via `measure_lexical_ranking.ts`. Cross-artefact note (2026-07-25): this baseline (3.333) is the value in THIS claim's own artefact and is cited correctly, but the retrieval-precision artefact records 4.111 for the same scorer on the same corpus — two bench scripts disagree. The lift direction (ties collapse to 1.0) holds under either baseline; the discrepancy itself is unresolved and recorded rather than smoothed.
 - kind: quant
-- evidence: internal/bench/reports/lexical-ranking.json
+- evidence: exec:measure_lexical_ranking -> 0
 - status: backed
 - last_verified: 2026-07-09
 
@@ -140,47 +158,47 @@
 - status: backed
 - last_verified: 2026-07-12
 
----
-
-## Unbacked inventory (documented debt — not yet markered in prose)
+### claim: ledger-exec-verifiability
+- claim: NONE of the backed ledger claims are machine-re-verifiable today — every evidence pointer is checked for existence (file present, substring present, URL carries a date), never for truth, so a claim pointing at a stale artefact stays backed indefinitely. A measured minority COULD carry a re-executing `exec:` form, clearing the >= 10 pp threshold that was pre-registered before the count was taken, which is why that form is scheduled rather than assumed. The rest cannot: paid or stochastic benchmark runs no CI job can re-derive, and prose contracts. Exact counts live in the evidence file and are NOT restated here on purpose — this entry hard-coded its denominator twice and drifted within a day both times (25 when the ledger held 26, then 26 when it held 27) while CI stayed green, because the pointer resolved. `check_claims` now compares the stored denominator against the live ledger and fails on divergence. A number a human retypes on every ledger edit will drift; the fix was to stop retyping it.
+- kind: quant
+- evidence: internal/reports/exec-evidence-feasibility.json#"exec_feasible"
+- status: backed
+- last_verified: 2026-07-25
 
-These are real README claims that need a durable binding before they may carry a
-`<!-- claim: -->` marker. Counts are drift-prone: binding them requires a
-count-source mechanism (a generated number the prose must match). That
-mechanism now exists (road-to-truth-and-reference-hygiene Phase 1):
-`update_counts.ts` generates every prose count from source, and
-`check_artefact_count_messaging.ts` fails CI on any count-shaped prose
-mention that drifts or is internally inconsistent — so the three count
-claims below are `backed`. Remaining entries are listed so the debt is
-visible, not hidden.
+### claim: enforcement-coverage-resolved
+- claim: 14 of 107 governed rules (13.1%) carry a backstop that fails a CI build. The number is RESOLVED, not declared — a `validator:` counts only when the script exists AND a GITHUB WORKFLOW reaches it (transitively, so a sub-check under a wired umbrella counts), and a hook registered `fail_closed: false` resolves to `observer`, never `validator`. The figure was 14 before this correction too, and it was wrong: the resolver treated `taskfiles/` and `.github/workflows/` as one corpus, so "named in a taskfile" counted as blocking — while NO workflow invokes `task ci`, `ci-strict`, or `ci-fast`. Nine of the thirteen validators only ran when a human typed the command. Split into `validator` (CI runs it) and `validator-local` (only a taskfile does), the honest figure was 5 of 107; wiring the nine into `rule-backstops.yml` returned it to 14, this time meaning what the headline says. `local_only` is now 0 and is ratcheted, so a gate cannot drop back out silently. Wiring them also surfaced that FIVE were already failing invisibly — 37 findings, baselined in `rule-backstop-debt.json` and ratcheted against growth. 86 rules declare nothing and count as uncovered, not excluded.
+- kind: quant
+- evidence: exec:check_enforcement_coverage --check -> 0
+- status: backed
+- last_verified: 2026-07-25
 
 ### claim: skill-count
-- claim: 278 skills.
+- claim: 281 skills.
 - kind: quant
-- evidence: src/scripts/check_artefact_count_messaging.ts#Artefact-count messaging gate
+- evidence: exec:check_artefact_count_messaging -> 0
 - status: backed
 - last_verified: 2026-07-08
 
 ### claim: command-count
 - claim: 190 commands.
 - kind: quant
-- evidence: src/scripts/check_artefact_count_messaging.ts#Artefact-count messaging gate
+- evidence: exec:check_artefact_count_messaging -> 0
 - status: backed
 - last_verified: 2026-07-08
 
 ### claim: rule-count
-- claim: 105 governed rules.
+- claim: 107 governed rules.
 - kind: quant
-- evidence: src/scripts/check_artefact_count_messaging.ts#Artefact-count messaging gate
+- evidence: exec:check_artefact_count_messaging -> 0
 - status: backed
 - last_verified: 2026-07-08
 
 ### claim: host-agent-count
-- claim: Compiled into 7+ host agents (Claude Code, Cursor, Augment, Cline, Windsurf, Copilot, Gemini).
+- claim: 23 host agents are detected and inventoried; 20 receive a written config surface (18 projection + 1 plugin + 1 bundle target) and 3 are export-only (aider, zed, jetbrains). The count is enforced, not asserted — `knownToolIds()` is pinned at 23 by a test whose assertion literal IS the number, and `src/config/surface-matrix.yml` is held in set-equality with the installer's own user-scope path map by `lint_surface_matrix`, so a host added to one and not the other fails the build. This entry stood `unbacked` while naming its own unblocking condition ("once `surface-matrix.yml` exists, bind the count to that file and flip"); the condition was met and nothing fired, so the shipped figure stayed "7+" — understating real coverage by 3x.
 - kind: quant
-- evidence: stays unbacked pending a machine-readable projection-targets list — the concrete binding artifact is `src/config/surface-matrix.yml` (authored by road-to-install-path-convergence Phase 2, per the 2026-07-07 install-path council); once it exists, bind the count to that file and flip. Triaged 2026-07-08 (truth-and-reference-hygiene P3): do NOT bind to prose host tables (`docs/enforcement-by-host.md`) — a substring pointer cannot verify a count.
-- status: unbacked
-- last_verified:
+- evidence: exec:vitest run tests/install/toolDetection.test.ts -> 0
+- status: backed
+- last_verified: 2026-07-25
 
 ### claim: orchestration-dispatch-net-win
 - claim: On the ordered-refactor + competitive-impl families (`orch-02`, `orch-03`), contract-governed subagent dispatch nets ≥15% token-or-wall reduction at non-regressed quality vs single-agent execution.
@@ -225,11 +243,11 @@ visible, not hidden.
 - last_verified: 2026-07-12
 
 ### claim: retrieval-substrate-live-pass
-- claim: On the live end-to-end retrieval benchmark (9 tasks × 3 arms × 3 seeds on claude-haiku, fixture store with keyword-overlapping confusers), the memory retrieval substrate scored precision@5 = 100% (9/9) with 100% poisoned-entry rejection, and the retrieval-on arm passed 27/27 model-scored tasks vs 2/27 with retrieval off and 4/27 with a placebo injection. Known limit stays published: mean tie-set 4.1 means top-k ties break by store order, not relevance (the ADR-116/FTS5 signal).
+- claim: On the live end-to-end retrieval benchmark (9 tasks × 3 arms × 3 seeds on claude-haiku, fixture store with keyword-overlapping confusers), the memory retrieval substrate scored precision@5 = 100% (9/9) with 100% poisoned-entry rejection, and the retrieval-on arm passed 27/27 model-scored tasks vs 2/27 with retrieval off and 4/27 with a placebo injection. Known limit stays published: mean tie-set 4.111 means top-k ties break by store order, not relevance (the ADR-116/FTS5 signal). SOLE RECORD for this artefact as of 2026-07-25: a second entry (`second-brain-retrieval-precision`) described the same measurement from the precision angle and had drifted to 5/27, 5/27 and tie-set 3.3 — figures absent from the shared artefact. Two entries over one artefact is what allowed them to disagree while both resolved, so the pair was folded into this one.
 - kind: quant
 - evidence: internal/bench/reports/second-brain-retrieval.json#retrieval-on
 - status: backed
-- last_verified: 2026-07-12
+- last_verified: 2026-07-25
 
 ### claim: wedge-hollow-detection
 - claim: On the A3 orchestration eval (deterministic verify, measured token deltas), the production-validator subagent returned the correct verdict on both fixtures — NOT READY with the exact `file:line` citation on a planted hollow implementation, READY with zero spurious findings on the clean control — while consuming ~45k fewer tokens than the inline-host baseline on each task. Scope: two planted fixtures on a Claude Code host, not a broad hit-rate.
@@ -257,4 +275,12 @@ visible, not hidden.
 - kind: quant
 - evidence: docs/benchmark.md#adversarial-verification-council
 - status: unbacked
-- last_verified:
+- last_verified: 2026-07-21
+- resolution: HONEST-NULL (resolved, not pending). Registered cross-vendor run 2026-07-21 on the curated judge-survivable corpus (internal/bench/adversarial-council/): on the judge-passed residual, the 2-vendor skeptic panel (anthropic+openai) matched the single skeptic exactly (residual recall 0.6 = 0.6, zero lift — the second vendor's residual catches were a strict subset of the first), at a 100% false-positive rate on the controversial-but-correct controls under the adversarial-skeptic posture. Both recall thresholds missed → honest-null → Mode 9 surface stays default-off permanently (like recursive-verification). Reproducible artifact: internal/bench/adversarial-council/runs/. Note: an initial run via `council_cli run` was REJECTED as a measurement artifact (that transport imposes multi-round peer-review + prose output, defeating the independent-skeptic + JSON-scoring protocol) — the valid run uses direct independent per-vendor client calls.
+
+### claim: gated-platform-reads
+- claim: A credential-free prescription layer reads content the host's own web tools cannot fetch at all — Reddit thread text (Atom feeds) AND comment ranking plus reply nesting (server-rendered HTML), and a single named tweet (the platform's own oEmbed endpoint). Measured 2026-07-25 from a residential network against a pre-registered 6-task-per-channel set with a native control and thresholds frozen before the run: reddit tier 1 6/6, reddit tier 2 6/6, twitter-oembed 6/6, native 0/6 on both Reddit tiers. Zero credentials, zero resident processes, zero auto-installs. Scope bounds that travel WITH the claim: (a) the twitter gap is narrower than 6/6 suggests — native also passed 2 of those 6 via third-party mirrors, so the channel earns its place only on tweets nothing mirrors; (b) reddit tier 2 is on an announced closing path and ships with a kill-switch keyed on an OBSERVED login wall; (c) youtube-transcripts is PARKED, not shipped — its backend is human-installed by contract and was never exercised; (d) residential network is load-bearing, and CI is explicitly not a bench environment.
+- kind: quant
+- evidence: docs/benchmark.md#ship-gated-reach
+- status: backed
+- last_verified: 2026-07-25

package/docs/architecture.md

@@ -146,8 +146,8 @@ note, package-internal path-swap, description budget, and the
 
 | Layer | Count | Purpose |
 |---|---|---|
-| **Skills** | 278 | On-demand expertise — stack analysis (Laravel · Symfony · Zend / Laminas · Next.js · React · Node), testing, Docker, API design, security, observability, … |
-| **Rules** | 105 | Always-active constraints — coding standards, scope control, verification, language-and-tone, agent-authority |
+| **Skills** | 281 | On-demand expertise — stack analysis (Laravel · Symfony · Zend / Laminas · Next.js · React · Node), testing, Docker, API design, security, observability, … |
+| **Rules** | 107 | Always-active constraints — coding standards, scope control, verification, language-and-tone, agent-authority |
 | **Commands** | 190 | Slash-command workflows — `/commit`, `/create-pr`, `/fix ci`, `/optimize skills`, `/feature plan`, `/work`, `/implement-ticket`, `/condense`, … |
 | **Guidelines** | 101 | Reference material cited by skills — PHP patterns, Eloquent, Playwright, agent-infra, … |
 | **Templates** | 7 | Scaffolds for features, roadmaps, contexts, skills, overrides |