@event4u/agent-config 9.6.0 → 9.8.0

package/docs/decisions/ADR-127-enforcement-claims-must-resolve.md

@@ -0,0 +1,150 @@
+---
+adr: 127
+status: accepted
+date: 2026-07-25
+decision: enforcement-claims-must-resolve
+supersedes: —
+superseded_by: —
+phase: road-to-enforcement-proof · P1–P5
+type: structural
+review_trigger: >-
+  When resolved enforcement coverage stops rising across two consecutive
+  releases while rules keep being added — that would mean the field is being
+  filled in to satisfy the gate rather than to record a real backstop, and the
+  ratchet has become ceremony. Also reopen if a `validator:` declaration is
+  found resolving green through an indirection that does not actually execute
+  it, which would mean the reachability test has itself become fail-open.
+---
+
+# ADR-127 — An enforcement claim must resolve, not merely exist
+
+## Status
+
+**Accepted** · 2026-07-25.
+
+## Context
+
+A source-level comparison against an external governance reference surfaced one
+defect class this package could not see from the inside: **prose that asserts
+enforcement the code does not deliver.** Four verification agents re-read every
+load-bearing claim against this repo's own source. Five instances survived
+verification:
+
+- `src/rules/output-discipline.md` asserted "violations cause a CI exit-code-2"
+  while `lint_output_slop.ts` shipped and was wired into nothing.
+- `check_kernel_rule_bundle.ts` — the one-kernel-rule-per-PR slow-rollout gate —
+  watched `.agent-src.uncondensed/rules`, a tree retired in the ADR-051 move to
+  `src/`. A path that cannot exist never matches, so the gate reported "no kernel
+  rule touched" for every kernel-rule edit, indefinitely.
+- `docs/contracts/subagent-boundary.md` stated as fact that "every floor applies
+  inside the subagent"; the brief schema, the spawn composer, and all eight
+  worker-prompt templates contained no floor text at all.
+- The override layer documented no non-overridable class, so the shipped consumer
+  README described unconditional whole-file shadowing — an empty file at
+  `agents/overrides/rules/non-destructive-by-default.md` reading as a way to
+  remove the Hard Floor.
+- 128 ADRs, zero naming a revisit condition, because ADR frontmatter was
+  **entirely unvalidated** — `validate_frontmatter.ts` covered skills, rules,
+  commands, and personas and nothing covered `docs/decisions/`.
+
+Nothing in the existing gate set could detect any of them, for one shared reason:
+**every gate checked that a pointer resolves, never that a claim is true.** The
+claims ledger is the clearest case — three evidence forms, all existence checks
+(file present, substring present, URL carries a date), and a `last_verified`
+field that is parsed and compared to nothing.
+
+The reference object's most transferable norm, and the one adopted here: a rule
+with no feasible enforcement tier is deleted rather than kept as honor-system
+theatre, and a check with no real input is left unwired rather than run as
+decoration. Notably, the reference violates its own version of this in two places
+(a nucleus its ADR sizes at "~15 lines" that is 9; a freshness check its ADR
+promises as FAIL that registers WARN) — which is itself evidence that the defect
+class is structural, not a lapse of care.
+
+## Decision
+
+**An enforcement claim is credited only when it resolves against the filesystem
+AND the wiring. Declaration is not evidence.**
+
+1. Rules carry `enforced_by:` — `hook:` / `validator:` / `test:` / `observer:` /
+   `none` — and `check_enforcement_coverage.ts` **resolves** each value. A
+   `validator:` whose script exists but is reachable from no taskfile, workflow,
+   or hook manifest resolves to `unwired`, not covered. Reachability is
+   transitive, so a sub-check running under a wired umbrella counts; a mention in
+   a comment does not.
+2. **Blocking and instrumenting are different tiers.** A hook registered
+   `fail_closed: false` resolves to `observer`, never `validator`. Of 18
+   registered hooks, exactly one can block.
+3. `none` is legal and **counted**. Undeclared rules count as uncovered, not as
+   excluded — a coverage number over only the rules that opted in would be
+   flattering and useless. The published figure is 14 of 107 (13.1%).
+4. **Kernel and safety-floor rules are non-overridable, with a registry.** A
+   `replace`-mode override on one is refused; an `extend` (a tightening) requires
+   an entry in `agents/overrides/kernel-exceptions.yml`. Direction matters, not
+   identity — this package's own legitimate override *tightens*
+   `verify-before-complete`, and a blanket name ban would forbid it.
+5. **The override audit reports; it does not pretend to police.** A build-failing
+   lint on kernel-named override files would guard one of several routes by which
+   a consumer can tell a model to ignore a rule, and would relocate the rest out
+   of sight while reading as coverage. It hard-fails only on this package's own
+   authoring surface, where the coverage claim is true.
+6. **The subagent floor is generated and delivered.** Derived from the kernel rule
+   list, written into every dispatch prompt in `src/` **and** the shipped
+   `dist/agent-src/` projection, drift-gated with a FAIL.
+7. **ADRs name a revisit condition, not a cadence.** Required from 2026-07-25
+   forward, grandfathered by date rather than by an allowlist. A bare "annually"
+   is rejected — a calendar review is ignored; an event fires.
+8. **`exec:` evidence is scheduled by measurement, not by appeal.** The threshold
+   (≥ 10 pp of the backed ledger) was pre-registered before the count was taken;
+   the measured figure is 10 of 25 feasible (40 pp) against 0 today, so it
+   proceeds — in its own PR, not this one.
+
+## Consequences
+
+**Good.** The defect class is now continuously measurable and ratcheted: blocking
+coverage may not fall and unwired declarations may not rise. Two live defects
+were closed on the first run (D1, and the kernel gate watching a dead path), and
+a third — the floor missing from the shipped projection — was caught by grepping
+`dist/` after the generator's first pass. The kernel rule list is single-sourced,
+ending three copies and two "kept in sync with…" comments.
+
+**Cost.** 86 rules are undeclared and drag the published number down; that is
+intended, and it means the headline figure will look bad until the field is
+filled in honestly. `enforced_by` is a schema change on an
+`additionalProperties: false` schema, so it cannot be added ad hoc.
+
+**Accepted limits, stated rather than papered over.** The override carve-out is a
+norm with a partial gate: the layer is model-resolved, so an `extend` block whose
+prose says "ignore the above" passes, and other relax routes (a persona file,
+host config, a direct instruction) are outside its view. The subagent floor
+covers dispatches through this package's templates; whether a host-native spawn
+inherits anything is a host property this package does not control and does not
+claim. `non-destructive-by-default` remains `enforced_by: none` — no script can
+enforce "ask before you deploy", and adjacent hooks guard hook-bypass rather than
+destructive intent, so claiming them would inflate the number.
+
+## Alternatives
+
+- **Declaration-only `enforced_by`.** Rejected: it would have rated
+  `output-discipline` as enforced, which is the exact defect that motivated this.
+- **Blanket ban on kernel overrides.** Rejected on both council members'
+  reasoning: it forbids legitimate tightening, including this repo's own.
+- **A build-failing kernel-override lint.** Rejected as security theatre — see
+  Decision 5.
+- **Build `exec:` evidence first.** Rejected on sequencing: without the coverage
+  baseline there was no way to know whether a new evidence form, validator, and
+  renderer would move falsifiability by 7% or 60%.
+- **Retrofit `review_trigger` across all 83 structural/security ADRs.** Rejected:
+  it would mean inventing ~80 conditions to satisfy a field. Three ADRs with
+  demonstrably time-bound premises were retrofitted (ADR-016, ADR-109, ADR-110).
+
+## References
+
+- `internal/reports/enforcement-coverage.json` — the ratcheted baseline.
+- `internal/reports/exec-evidence-feasibility.json` — the pre-registered
+  measurement and its decision.
+- `docs/proof.md` § 2b — the published coverage figure and the ledger's own limit.
+- `docs/contracts/subagent-boundary.md` § Honest scope of the floor guarantee.
+- `src/agent-src/contexts/override-system.md` § The non-overridable class.
+- ADR-051 (`src/` as source of truth) — the move that silently disarmed the
+  kernel-bundle gate.

package/docs/decisions/ADR-128-executable-evidence-and-measured-escalation.md

@@ -0,0 +1,201 @@
+---
+adr: 128
+status: accepted
+date: 2026-07-25
+decision: executable-evidence-and-measured-escalation
+supersedes: —
+superseded_by: —
+phase: road-to-executable-evidence · P1–P4
+type: structural
+review_trigger: >-
+  When an `exec:` claim is found green while the thing it asserts is false —
+  which would mean the exit code stopped carrying the verdict and the form has
+  become a more expensive pointer. Also reopen when a ledger surface is edited
+  by anyone other than the maintainer, because contributor access is the
+  premise the deferred tamper-chain disagreement turned on and this package
+  does not have it yet.
+---
+
+# ADR-128 — Evidence that re-derives itself, and escalation that is measured before it bites
+
+## Status
+
+**Accepted** · 2026-07-25. Continues ADR-127.
+
+## Context
+
+ADR-127 made an enforcement claim resolve against the wiring rather than merely
+exist, and closed five live defects doing it. It deliberately left one thing
+measured and unbuilt, in its own Decision 8: the claims ledger still checked
+that an evidence pointer **resolves**, never that the claim is **true**. A ledger
+entry reading "the suite is green" whose pointer resolves to a report nobody
+regenerated stays `backed` indefinitely — the pointer resolves, the claim is
+false. The pre-registered threshold for building the fix was ≥ 10 pp of the
+backed ledger, set before counting; the measurement came back 11 of 26 feasible.
+
+A second round of the same external comparison raised four further candidates
+and a council was run over the cut (two members, two rounds). Both members
+independently scoped in the `exec:` form and a content-driven risk axis, and
+scoped out filling the 86 undeclared `enforced_by` fields and a
+lifecycle-scenario cost model. The reasoning is recorded below because kills
+that are not written down get re-proposed by the next analysis round.
+
+The missing risk axis is concrete rather than theoretical.
+`discipline_profile: auto` resolves rigor by host capability — *how much
+governance can this environment afford*. Nothing asks *how dangerous is this
+diff*. The live combination that leaves open: a weak host plus a diff in the
+installer's provenance path resolves to minimum discipline, which is precisely
+the change class hardened in 9.6.0. The fix landed; the process escalation for
+the next change of that class did not.
+
+## Decision
+
+**1. `exec:` is the fourth evidence form, and it re-runs the command.**
+`exec:<command> -> <exit-code>`. The exit code carries the verdict. The
+allowlist is a set of argv prefix tuples in
+`src/scripts/_lib/exec_evidence.ts`, never a regex over a command string — a
+regex over shell text is the classic bypass. Every argument after the matched
+prefix is re-checked for shell metacharacters and repo escape, **including the
+right-hand side of `--flag=value`**, without which `--rootdir=/etc` clears an
+allowlist that only inspected the flag name.
+
+**2. Re-execution is CI-only; the static half runs everywhere.** Whether a
+pointer is well-formed and allowlisted is a property of the *ledger*, so it
+fails on a laptop too. Whether the command actually passes is a property of the
+*environment*, so it runs only on an ephemeral CI runner and never in a
+consumer's checkout. Locally the gate reports `UNVERIFIED — re-execution is
+CI-only, skipped locally`, never a silent pass.
+
+**3. A skip is not a failure, and a failure is not a skip.** "Ran and
+disagreed" is a finding. "Could not run" is not. Collapsing the two turns the
+verifier into a rubber stamp in one direction or a nuisance in the other.
+
+**4. The feasibility count was corrected down by one, by building it.** Of the
+11 measured feasible, 10 survived contact. `context-token-reduction` was counted
+feasible because `check_token_regression` re-derives token figures with a real
+tokenizer — but the script reads `internal/bench/reports/projection-cost.json`,
+which is gitignored as a per-run artefact, so the command is not self-sufficient
+in a fresh checkout and exits 1. The `exec:` gate found this on its first CI
+run. The corrected figure is 10 of 26 (38.5 pp), still far above the
+pre-registered 10 pp bar, so the decision to build stands on the corrected
+number too — the over-count changed the margin, not the verdict.
+
+**5. The residue is published, not rounded away.** `docs/proof.md` states how
+many backed claims re-derive themselves versus rest on a pointer, and lists each
+non-re-executable claim with the reason: external cite, paid or stochastic
+benchmark output, or a prose contract with no exit code to carry a verdict.
+
+**6. Trust-boundary risk is classified now and gated later.** The classifier is
+path-based and reproducible from the diff alone — no model judgement about
+whether a change "feels risky". Three classes: authentication and token
+handling; installer, provenance, publish, and subagent-spawn paths; governance
+surfaces. The docs exemption is scoped to prose *about* a system, not to any
+markdown file: in this repo the rules, `AGENTS.md`, and the kernel set are all
+`.md` and are executable policy. An extension-only test classified
+`src/rules/icon-consistency.md` as unclassified, which a test caught before the
+report shipped.
+
+**7. Escalation is additive and the direction is encoded, not left to callers.**
+The host profile sets a floor; a risk trigger may only raise it. A weak host
+must never be able to lower an escalation — that inversion is the entire failure
+mode the second axis exists to prevent, so `escalated_floor` takes a maximum
+rather than trusting each call site to get the order right.
+
+**8. The non-declinable escalation is justified by measurement, and still not
+built here.** The threshold — ≥ 5 of ~100 first-parent merges landing in a
+trust-boundary class — was written into the roadmap before the report was first
+read. Measured: **11 of 99**. That clears the bar, so a non-declinable class for
+trust-boundary diffs is warranted and gets its own ADR and its own PR. It is
+deliberately not enabled by this one, because it trades away something the
+authority model holds (`agent-authority`, `ask-when-uncertain`) and that trade
+deserves its own decision record rather than riding along inside a measurement.
+
+**9. The prevented-failure table is generated and gated.** Each row names a
+failure mode rather than a feature, and cites a ledger claim. A cited id that is
+missing or not `backed` **throws** during generation. The format was borrowed
+from the reference; the discipline was not available to borrow — the reference's
+own equivalent table carries a headline efficiency figure that appears nowhere
+else, an order of magnitude below the cheapest scenario in its own generated
+benchmark. A number with nowhere to resolve is exactly what this ledger exists
+to catch, so the table is held to the ledger's bar.
+
+**10. Three candidates are closed rather than left open.**
+
+- **Filling the 86 undeclared `enforced_by` fields — deferred.** You cannot fill
+  them honestly without first building 86 enforcement points; what you get
+  otherwise is 86 `TODO` values, which is *strictly worse than a blank*. The
+  blank is honest about non-coverage; the TODO is a promise. This is the exact
+  failure ADR-127's own `review_trigger` names.
+- **Adversarial governance evals — killed.** A corpus of "user pressures the
+  agent to skip a gate" scores refusal as the pass condition, while this
+  package's documented authority model says the user decides. An eval asserting
+  "the agent must refuse when the user says no" would declare `agent-authority`
+  a security failure. The narrower question — does the enforcement mechanism
+  return non-zero — is already answerable per rule.
+- **A governed-writes lint — killed as the wrong layer.** A static scan for
+  `fs.writeFile` against protected paths is simultaneously too weak
+  (`child_process.exec('… > file')` walks past it) and too strong (fixture setup
+  trips it). Same reasoning as ADR-127 Decision 5: a gate covering one route of
+  several, while reading as coverage, is theatre. The type system is the right
+  layer if this is ever worth closing.
+
+**11. Tamper-evident chains — deferred with the disagreement recorded, not
+resolved by fiat.** Round 1 argued a hash chain adds nothing Git does not
+already provide, and that the external `git merge-base` line-prefix witness does
+all the work. Round 2 found the hole in that: a line-prefix witness catches
+**tail truncation** and does **not** catch **mid-sequence deletion** — dropping
+entries 50–90 out of the middle leaves a diff that is not a prefix violation and
+reads as an ordinary divergent branch. Neither round produced the number that
+settles it, which is how often a ledger surface is edited by someone other than
+the maintainer. That number is the revisit condition in this ADR's frontmatter.
+
+## Consequences
+
+**Good.** Machine-re-verifiable claims went from **0 to 10** of 27 backed. The
+form found a real defect on its first CI run — the over-counted feasibility
+entry — which is the gate doing the job it was built for, on itself. The risk
+classifier caught its own docs-exemption bug through a test before its report
+was published. Both are the intended shape: the instrument fails visibly rather
+than reporting a comfortable number.
+
+**Cost.** 17 of 27 backed claims still rest on pointers and cannot re-derive
+themselves; that is now stated on the proof page rather than implied away. The
+`exec:` allowlist is a maintenance surface — a renamed script silently drops a
+claim from re-verification to static-only, and nothing yet detects that
+downgrade.
+
+**Accepted limits, stated rather than discovered later.** The allowlist only
+covers commands whose exit code *is* the verdict; nothing about this form helps
+a claim resting on a paid benchmark. The path classifier sees paths, not intent:
+a dangerous change in a file it does not know about classifies as `none`, and
+the class list is a judgement that will need revisiting as the tree moves. The
+shadow report measures what *would* have escalated, which is not the same as
+what *should* have — it cannot tell whether those 11 merges were actually
+handled carelessly, only that they were in the class.
+
+## Alternatives
+
+- **Build `exec:` for all 26 claims.** Not possible, and the attempt would have
+  produced fake pointers for benchmark claims. 10 honest re-verifications beat
+  26 that only look uniform.
+- **Ship the non-declinable escalation in this PR.** Rejected on sequencing: the
+  measurement justifies it, but an authority-model trade deserves a decision
+  record a reader can find, not a paragraph inside a measurement PR.
+- **Let `exec:` run locally too.** Rejected: "commands execute in the repository
+  root with full filesystem access" is a property to confine, not to trust, and
+  a consumer's checkout has no business re-running this package's evidence.
+- **A regex allowlist.** Rejected — the reason the tuple form exists.
+- **Skip the prevented-failure table as marketing.** Rejected: the format names
+  failure modes rather than features, which is a better description of what this
+  package does than any feature list, and the ledger gate makes it falsifiable.
+
+## References
+
+- `internal/reports/exec-evidence-feasibility.json` — the pre-registered
+  measurement, its correction, and the built outcome.
+- `internal/reports/risk-escalation-shadow.json` — 11 of 99 first-parent merges,
+  against a threshold fixed before the first read.
+- `src/scripts/_lib/exec_evidence.ts`, `src/scripts/_lib/risk_paths.ts`.
+- `tests/scripts/exec_evidence.test.ts` — the abuse cases for the allowlist and
+  the argument hardening.
+- ADR-127 — the enforcement-resolution decision this continues.

package/docs/decisions/INDEX.md

@@ -127,6 +127,11 @@ _Auto-generated by `scripts/adr/regenerate_index.py`. Do not edit._
 | [ADR-121](ADR-121-knowledge-sensitivity-classes.md) | Knowledge Sensitivity Classes | accepted | 2026-07-12 | — |
 | [ADR-122](ADR-122-adversarial-verification-council.md) | Adversarial Verification Council | accepted | 2026-07-14 | — |
 | [ADR-123](ADR-123-runtime-security-scope-and-spawn-hardening.md) | Runtime Security Scope And Spawn Hardening | accepted | 2026-07-20 | — |
+| [ADR-124](ADR-124-embedded-engine-doctrine.md) | Embedded Engine Doctrine | accepted | 2026-07-23 | ADR-088 (engine-adoption interpretation only), ADR-094 (engine-adoption interpretation only) |
+| [ADR-125](ADR-125-doc-screenshot-anonymization.md) | Doc Screenshot Anonymization | accepted | 2026-07-23 | — |
+| [ADR-126](ADR-126-internet-reach-operator-tooling.md) | Internet Reach Operator Tooling | accepted | 2026-07-24 | — |
+| [ADR-127](ADR-127-enforcement-claims-must-resolve.md) | Enforcement Claims Must Resolve | accepted | 2026-07-25 | — |
+| [ADR-128](ADR-128-executable-evidence-and-measured-escalation.md) | Executable Evidence And Measured Escalation | accepted | 2026-07-25 | — |
 | [ADR-200](ADR-200-python-to-typescript-migration.md) | Python To Typescript Migration | accepted | 2026-06-11 | — |
 
 ## Unnumbered (legacy)
@@ -134,3 +139,19 @@ _Auto-generated by `scripts/adr/regenerate_index.py`. Do not edit._
 | # | Title | Status | Date | Supersedes |
 |---|---|---|---|---|
 | [ADR-rule-kernel-and-router](ADR-rule-kernel-and-router.md) | Rule Kernel And Router Roadmap Closure | accepted | 2026-05-06 | — |
+
+## Decision records outside this directory
+
+Scanned, not hand-listed. These files are titled `# ADR — …` and record a
+decision, but live elsewhere in the tree. They are indexed here so a decision
+cannot be unfindable merely because of where it was filed; their paths are
+unchanged and their inbound references still resolve.
+
+| File | Title | Status |
+|---|---|---|
+| `agents/settings/contexts/adr-always-budget-relief-strategy.md` | Always-Budget Relief Strategy (parked, reactivation-gated) | Decided |
+| `agents/settings/contexts/adr-always-rule-context-split-not-viable.md` | Splitting an Always-rule into rule + `load_context:` is not viable under Model (b) | Decided |
+| `agents/settings/contexts/adr-artifact-engagement.md` | Artefact-Engagement Telemetry | Decided |
+| `agents/settings/contexts/adr-auto-rule-consolidation.md` | Auto-Rule Consolidation (review-routing + transient-references pairs) | locked |
+| `agents/settings/contexts/adr-frugality-savings-baseline.md` | Frugality Canon Savings Baseline | Decided |
+| `agents/settings/contexts/adr-work-engine-rename.md` | Universal Execution Engine: rename `implement_ticket` → `work_engine` | Decided |

package/docs/decisions/engine-reclassification-2026-07.md

@@ -0,0 +1,104 @@
+# Engine re-classification sweep (ADR-124 § 4)
+
+> Committed 2026-07-23 as the mandatory re-evaluation sweep required by
+> ADR-124 § 4. Population inventoried across every roadmap disposition
+> (active, archive, later, skipped, stubs): **44 engine-shaped REJECT
+> records** recorded 2026-06-01 → 2026-07-22. Each is re-classified under the
+> ADR-124 class boundary — **A** (embedded, deterministic, in-process,
+> command-invoked → adoptable), **B** (resident service/daemon → prohibited
+> in core), **C** (network/LLM in the *build path* → prohibited by default).
+>
+> **Discipline this table enforces:** no silent re-openings, no silent
+> re-affirmations. A Class-A re-opening becomes a *candidate* only — adoption
+> stays demand- and benchmark-gated, and it enters build work solely through
+> the ADR-124 sequencing rule (one native engine at a time). Class-B/C
+> verdicts are re-affirmed with the class cited, so a later cycle cannot
+> misattribute the reason to the runtime identity when it was really scope,
+> demand, or redundancy.
+>
+> External references are cited by anonymized descriptor per
+> `source-confidentiality`; no roadmap-file paths are linked per
+> `no-roadmap-references` (this is a stable artifact).
+
+## How to read a row
+
+`class` is the ADR-124 verdict. `disposition`:
+
+- **RE-OPENED (candidate)** — Class A; the old reason does not survive ADR-124;
+  now gated by the named gate, not by existence.
+- **RE-AFFIRMED** — the reject stands; the class is why (B = residency, C =
+  network/LLM build path).
+- **STAY-KILLED / CLOSED** — Class A by mechanism but re-affirmed on
+  redundancy or demand grounds, not identity.
+
+## Headline engine rejects
+
+| # | source cycle (anon.) | engine / capability | old verdict (quote) | class | disposition | gate |
+|---|---|---|---|---|---|---|
+| 1 | code-graph reference (Source G) | tree-sitter / AST extraction engine | "NO tree-sitter / AST engine in this repo" | **A** | **RE-OPENED** | this roadmap; falsification + Phase-5 bench for default-on |
+| 2 | code-graph orchestration (skipped v1) | vector store / embedding service / always-on daemon in index path | "NO vector store, NO embedding service, NO always-on daemon" | split | vector-store **A** if embedded-deterministic; embedding-svc **C**; daemon **B** | per-item; vector-store not scheduled (no demand) |
+| 3 | flow-learnings | MCP deferred-rule retrieval **server** | "council REJECT (2026-07-07)" | **B** | **RE-AFFIRMED** (resident server; residency is the trait — an MCP server can run stdio without network) | a *command-invoked* retriever is Class A → `later/road-to-deferred-rule-retriever`, unblock = 3 re-open conditions + Phase-5 verdict |
+| 4 | flow-learnings | SQLite memory **service** / vector clocks / distributed memory | "SQLite memory *service* … sunset stands" | **B** | **RE-AFFIRMED** | embedded FTS5 (`node:sqlite`) is the Class-A slice, already pre-decided (ADR-116) |
+| 5 | flow-learnings | web console / live monitoring UI | "no runtime to monitor" | **B** | **RE-AFFIRMED** | — |
+| 6 | flow-learnings | runtime orchestration (work-stealing, load balancing) | cites ADR-088 | **B** | **RE-AFFIRMED** | ADR-088 literal text binds (federation); the work-stealing gloss is this council line, not ADR-088 |
+| 7 | operator-runtime harvest (Source A/E) | browser **daemon** + L1–L6 security | "REJECT (core) → route to plugin … compiled runtime betrays no-runtime identity" | **B** | **RE-AFFIRMED**, plugin routing stands | reopen = the three domain-adoption hypotheses |
+| 8 | operator-runtime harvest | `careful`/`freeze`/`guard` runtime enforcement | "REJECT (core) → route to plugin \| no-runtime scope trap" | **B** | **RE-AFFIRMED** (adopted as discipline only) | plugin repo |
+| 9 | operator-runtime harvest | skill-graph / workflow-graph engine | "STAY KILLED … `work_engine/` already runs a directive graph" | **A** | **STAY-KILLED** (redundant with in-process `work_engine/`, not identity) | evidence of a real gap `work_engine` cannot serve |
+| 10 | operator-runtime harvest | `model-overlays/` per-model behavioral patch | "GATE (default-off) … falsified at current scale (honest-null); duplicates RDP" | **A** | GATED (not forbidden) | reopen if a keystone probe exposes RDP failure on a real host |
+| 11 | positioning-and-enforcement (Source A) | compiled **control plane** / runtime hooks | "no daemon … compiled control plane … runtime MCP hooks = Tier-2 opt-in/experimental" | **B** | **RE-AFFIRMED** (positioning asset) | flip if >60% of active users are on hook-capable hosts |
+| 12 | subagent-value-realization (Source A subagent harvest) | in-process "swarm" Map / topology **engine** + consensus voting | "CUT → an in-process actor runtime is identity-rejected (no-runtime)" | **B** | **RE-AFFIRMED** by the ADR-109 identity floor (terminates-in-command is not enough) | the routing `_lib` deterministic fns are already Class A and shipped — only the runtime shell was rejected |
+| 13 | orchestration-scope-decision (active) | swarm front (100+ agents, background daemon, memory DB) | "the swarm category ships … background daemon, memory DB" | **B** | **RE-AFFIRMED** | its own honest-exit decision; competitor shape stays out |
+| 14 | persona-library harvest | host-plugin runtime router | "REJECT \| ADR-109 no-runtime floor + ADR-088 … reopen only via superseding ADR" | **B** | **RE-AFFIRMED** | needs its own superseding ADR (ADR-124 does not open it — runtime router on a host is Class B) |
+| 15 | persona-library harvest | BYO MCP-memory 4-tool contract | "REJECT \| heavyweight memory removed (ADR-094)" | **C** | **RE-AFFIRMED** | ADR-094 binds |
+| 16 | persona-library harvest | declarative projection-target registry + semantic adapters | "REJECT (council, unanimous) \| surface-matrix already stronger; zero demand" | **A** | **CLOSED** (redundancy + demand, not identity) | per-host defer on a real logged request |
+| 17 | persona-library harvest | `catalog_delegate` auto-activation tool | "REJECT \| write-adjacent auto-activation; violates default-off + ADR-109" | **A** (logic) | **CLOSED** on auto-activation policy | not engine identity |
+| 18 | universal-os reframe | UI control plane (Electron / web UI) | "Reject \| explicitly 'not a runtime'; host agents provide UI" | **B** | **RE-AFFIRMED** | — |
+| 19 | universal-os reframe | memory governance per domain | "Reject \| stateless YAML/MD; memory is host responsibility" | **B** | **RE-AFFIRMED** | — |
+| 20 | universal-os reframe | marketplace / pack-ecosystem infra | "Reject \| zero third-party packs exist … vapor work" | **B** | **RE-AFFIRMED** | when third-party packs exist |
+| 21 | small-enhancements harvest | continuous-learning auto-write store; cron/dispatch; control-pane SQLite runtime; knowledge-graph MCP | "All other harvest REJECTS … stand" | **B**/**C** | **RE-AFFIRMED** | file-first `patterns/` was the only reversal |
+| 22 | agent-memory removal | Layer-2 memory (PostgreSQL + pgvector + MCP + decay + trust) | "architecturally unsound for a 'no app runtime' suite" | **C** | **RE-AFFIRMED** (canonical Layer-2 sunset origin) | — |
+| 23 | memory-retrieval economy | always-on worker/service, Chroma, Postgres; write-time LLM observation | Non-goals: "any always-on worker/service, Chroma, Postgres runtime"; "write-time LLM … unmetered cost" | **B**/**C** | **RE-AFFIRMED** | embedded FTS5 is the Class-A slice, measurement-gated (ADR-116) |
+| 24 | opt-retrieval-and-memory (Source G protocol) | code-graph **engine** (vectors / embedded DB / background service) | "No vectors, no embedded DB, no background service — the Layer-2 sunset" | **B**/**C** for the rejected shapes | **RE-AFFIRMED** for services; the *protocol borrows* (edge confidence, BM25, budget envelope) were Class A and already shipped | the native deterministic engine (this roadmap) is the Class-A re-opening |
+| 25 | knowledge-system | vector/semantic search, transcript-RAG; runtime policy engine | "Layer-2 sunset stands … no search infra"; "runtime policy engine … CUT" | **B**/**C** | **RE-AFFIRMED** (Jaccard similarity check adopted instead — Class A) | — |
+| 26 | evidence-v2 project-intelligence | DB / vector store / daemon / runtime self-modifying store | "not add a DB, vector store, daemon, or runtime" | **B**/**C** | **RE-AFFIRMED** (suggestion-gated instead) | — |
+| 27 | analysis-workbench | state-machine runtime / investigation daemon | "would violate the no-runtime boundary … human-gated re-invocation, not a daemon" | **B** | **RE-AFFIRMED** | achieved via human-gated re-invocation |
+| 28 | second-brain | Obsidian vault; NLI contradiction detection; static HTML renderer | "rejected 2/2 … not in scope (decided, not deferred)" | NLI **C**; HTML renderer **B**; BM25 **A** (tripwire-gated) | **RE-AFFIRMED** | HTML renderer revisit-if browsing demand |
+| 29 | retrieval-substrate hardening | watch-**daemon**; engine-fork / minisearch-class dep | "watch-daemon CUT … no engine-forks (ADR-061)" | watch-daemon **B**; BM25 core **A** (shipped) | **RE-AFFIRMED** | FTS5 pre-decided path |
+| 30 | capability-governance | runtime gating **engine** / generic consent machinery | "deferred until N≥2 high-risk domains" | **A**/**B** | DEFERRED (not killed) | reopen at N≥2 high-risk domains; an in-process evaluator is Class A → see `later/road-to-policy-evaluation-core` |
+| 31 | governance-moat | per-skill capability registry | "DO NOT BUILD. maintainability theater with no consumer" | **A** | **CLOSED** (demand/theater, positioning asset) | — |
+| 32 | mcp-distribution | native SSE server | "explicitly rejected … build a bridge, not native" | **C** | **RE-AFFIRMED** | if revived, build a bridge |
+| 33 | mcp-server | tools primitive / engine spawn / state writes / shell exec (Phase 1) | "read-only and instructional … no engine spawn, no state writes, no shell execution" | **C** | **RE-AFFIRMED** (hard read-only floor) | later phases |
+| 34 | loop-engineering | closed measure→adjust loops (auto-demotion/pruning, bench-drift blocking) | "REJECT auto; stays manual … no daemon per ADR-088" | **B** | **RE-AFFIRMED** (manual gate adopted) | each row's revisit-if |
+| 35 | video-deferred design | skill suite behaving as a runtime | "don't build a skill suite as if it were a runtime" | **B** | **RE-AFFIRMED** (meta-guardrail governing the whole class) | — |
+| 36 | mcp-runtime stub | FastMCP / MCP TS SDK (runtime additions) | "FastMCP rejected on safety-audit width; MCP TS SDK on Node-runtime addition" | **C** | **RE-AFFIRMED** | minimal low-level SDK chosen |
+| 37 | originality-gate / contributor-funnel (later/) | standalone zero-config validator engine | "KEEP, demand-gated — Phase-3 probe before any extraction" | **A** | DEMAND-GATED (extractable) | ≥N external-repo signals in the 90-day probe window |
+| 38 | event-driven-discipline (skipped) | move discipline onto hook dispatcher (event-driven runtime) | "CANCELLED, all steps DROPPED … multi-week engineering" | **B** | **RE-AFFIRMED** (cost-rejected) | — |
+
+## Supporting / engine-adjacent rejects (completeness)
+
+| # | source cycle (anon.) | item | class note |
+|---|---|---|---|
+| 39 | competitive-borrow | standalone queryable state-store; second similarity engine | **A** — folded into an existing in-process command; do not build a second similarity engine |
+| 40 | lean-initial-context | embedding-router; rule-virtualization; task-classifier | embedding-router **C**; others **A**, "do not build unless re-opened" |
+| 41 | capability-discoverability | per-skill Skill-DAG auto-chaining | **A** — rejected on a sequencing chicken-egg; reopen when a real dependency appears |
+| 42 | contract-integrity (later/) | no-runtime config-surface guard (forbids `vector`/`daemon`/`decay`/`pgvector` keys, `setInterval`/`setTimeout`) | **enforcement mechanism** for B/C rejects — MUST gain a Class-A exception when it lands (ADR-124 § 6); see below |
+| 43 | recursive-verification | router-learning loop; GAN builder | **B** — learning loop/daemon |
+| 44 | autonomous-verify-loop | opus-pinned 3-agent GAN loop | **C** — LLM-in-loop; N=3 cap + judge discipline kept |
+
+## Class-A re-openings — the queue (sequencing rule: one at a time)
+
+1. **Native code-graph engine** (#1, #24) — RE-OPENED, built by this roadmap.
+2. **Command-invoked deferred-rule retriever** (#3) — `later/road-to-deferred-rule-retriever.md`, blocked on Phase-5 verdict + demand.
+3. **Deterministic policy-evaluation core** (#12 slice, #30) — `later/road-to-policy-evaluation-core.md`, blocked on Phase-5 verdict + demand.
+
+No other row is scheduled. Every future Class-A adoption exits this table only with a named demand signal and its own roadmap.
+
+## Config-surface guard obligation (ADR-124 § 6)
+
+Entry #42 is the live enforcement point: a planned no-runtime config-surface
+guard denylists `vector`/`daemon`/`decay`/`pgvector` keys and
+`setInterval`/`setTimeout` outside dev tooling. When that guard lands it MUST
+carve out Class-A engine surfaces (this roadmap's `code_graph/` module and the
+`hooks.code_graph` setting), or Class-A engines fail CI after the doctrine
+flipped. This obligation is recorded here and cited from ADR-124 § 6; the guard
+roadmap, when executed, cites this file back.

package/docs/distribution/awesome-list-submission.md

@@ -29,7 +29,7 @@ other install, no runtime.
 
 **event4u/agent-config** — a governed, no-runtime configuration layer for AI
 coding agents: audited skills, review personas, rules, and commands projected
-into 7+ hosts (Claude Code, Cursor, Windsurf, Copilot, …). Its distinguishing
+into 20 hosts (Claude Code, Cursor, Windsurf, Copilot, Codex, Continue, …). Its distinguishing
 discipline: **every public claim is machine-checked** — the README binds each
 claim to resolvable evidence in a Claims-Ledger, and a generated proof page lets
 anyone reproduce the checks (`docs/proof.md`). Bring your own model.

package/docs/distribution/registries.md

@@ -37,7 +37,7 @@ No bespoke `BREAKING_CHANGES.md` is maintained — the changelog is the authorit
 
 | # | Registry | URL | Submission shape | Status | PR link |
 |---|---|---|---|---|---|
-| 1 | `punkpeye/awesome-mcp-servers` | <https://github.com/punkpeye/awesome-mcp-servers> | One-line entry under the Developer-Tools section + Glama score badge | 🟡 PR open (awaiting maintainer review) | <https://github.com/punkpeye/awesome-mcp-servers/pull/6865> |
+| 1 | `punkpeye/awesome-mcp-servers` | <https://github.com/punkpeye/awesome-mcp-servers> | One-line entry under the Developer-Tools section + Glama score badge | ❌ **PR closed unmerged 2026-06-11** (verified live 2026-07-25 via `gh pr view 6865`; this row previously read "PR open" for six weeks) | <https://github.com/punkpeye/awesome-mcp-servers/pull/6865> |
 | 2 | `mcp.so` | <https://mcp.so/> | Submit via the directory form; same one-line shape | ✅ submitted (maintainer-confirmed 2026-06) | — |
 | 3 | `mcpservers.org` | <https://mcpservers.org/> | Submit via the directory form; same one-line shape (verify URL current at submission time) | ✅ submitted (maintainer-confirmed 2026-06) | — |
 | 4 | `glama.ai` | <https://glama.ai/mcp/servers/event4u-app/agent-config> | Server page live; score badge embedded in the awesome-mcp-servers entry (PR #6865) | ✅ listed (server page + badge return HTTP 200, verified 2026-06-08) | <https://glama.ai/mcp/servers/event4u-app/agent-config> |
@@ -50,37 +50,46 @@ Use this exact text for the awesome-list entry. Adjust the link anchor per direc
 - [event4u/agent-config](https://github.com/event4u-app/agent-config#readme) — Universal AI Agent OS. Audited skills, governance rules, commands, and templates for Claude Code, Cursor, Windsurf, Copilot. Bring your own provider.
 ```
 
-## PR body update — 3.2.0 reality
+## Submission body — ledger-bound, version-agnostic
 
-When the maintainer opens the PR / posts the directory entry, the
-description block carries the concrete reality the 3.2.0 review
-named. Reviewer verbatim quote: *"deutlich mehr vorzuweisen als bei
-jedem vorherigen Erwähnungszeitpunkt."* The numbers below mirror the  <!-- md-language-check: ignore -->
-3.2.0 release notes and the `task adoption:status` snapshot from
-that release; refresh them before posting if a later release has
-shipped.
+Reuse this block in any directory submission or PR description.
+
+It deliberately carries **no artefact counts and no version number.** The block
+this replaced described version 3.2.0 with figures like "4929 tests" and role
+experiences that no longer exist; it sat here for months while the package
+reached 9.7.0, because this file is not scanned by the artefact-count gate
+(it is now — see § Drift guard). A stale number on a public growth surface is
+precisely what this package positions against, so the shape below cannot rot:
+every figure resolves through [`docs/CLAIMS.md`](../CLAIMS.md), and anything you
+add needs a ledger entry or it does not go in.
 
 ```
-event4u/agent-config 3.2.0 ships:
-
-- 4929 tests across Python + TypeScript matrix (Linux + macOS).
-- /knowledge cluster — local-only document ingestion via markitdown;
-  per-namespace memory_retrieve with trust scoring.
-- Three role experiences (galabau / content-creator / consultant) +
-  daily workspace browser surface in the modern Preact shell.
-- Cinematic AI-video pipeline (/video:from-script, /video:scene,
-  /video:storyboard, /video:stitch) — provider-agnostic; dry-run
-  default; the package never sees API keys.
-- 9 Iron-Law rules + tier-1/2 routed kernel; ai-council
-  second-opinion loop for high-impact decisions.
-
-Bring your own provider (Anthropic / OpenAI / Google / Cloudflare).
-No SaaS; no remote sync; npx-quickstart installs in ~3 minutes.
+event4u/agent-config — a governance and content layer for AI coding agents,
+compiled into each host's native format. Bring your own provider: no SaaS, no
+remote sync, and no background daemon (claim: no-runtime-daemon).
+
+What is different is falsifiability. Every public claim binds to evidence a
+skeptic can reproduce on a fresh checkout, and the runs where the layer changed
+nothing are published too (claim: positioning-honest-nulls). The measured wedge
+is deliberately narrow: on weak or cheap hosts the `essential` tier transplants
+scope and downstream-change discipline at a measured 1.71x corpus cost, and it
+switches itself off on hosts where the effect measured null.
+
+Start at the proof, not the catalog:
+https://event4u-app.github.io/agent-config/proof/
 ```
 
-Drop this block into the PR description once and reuse it across
-the three registries; it is the "deutlich mehr vorzuweisen" frame
-condensed to a half-screen.
+Before pasting, verify: `task check-claims` is green on `main`, and each
+`claim:` id above still resolves to a `backed` entry. Artefact counts belong in
+the README badges (`update_counts` owns them) — never hand-typed into a listing.
+
+## Drift guard
+
+`docs/distribution/registries.md` is in
+[`check_artefact_count_messaging`](../../src/scripts/check_artefact_count_messaging.ts)
+`SURFACES`, so any artefact count that appears here must match the canonical
+number or CI fails. That is the structural fix for the rot described above:
+the previous block went stale silently because nothing watched this file.
 
 ## Submission checklist
 

package/docs/enforcement-by-host.md

@@ -31,6 +31,13 @@ it a two-tier experience — strong on Claude, absent on Cursor/Windsurf/Copilot
 So the universal lever is the compile-time layer; runtime hooks are an opt-in
 **bonus** on the hosts that can run them, never the floor.
 
+The ADR-124 code-graph nudge is a case in point: on hook-capable hosts the
+default-off `code-graph` PreToolUse hook surfaces "query the graph first" once
+per session; on instruction-file hosts the same intent rides the always-loaded
+[`external-code-graph-interop`](../src/rules/external-code-graph-interop.md)
+rule and the [`code-intelligence`](../src/skills/code-intelligence/SKILL.md)
+skill — the capability degrades gracefully, it does not disappear.
+
 **Where MCP fits.** MCP is a *transport* surface, not a third enforcement layer.
 On a host that runs MCP servers, MCP is one path by which a tool lifecycle (and
 therefore the runtime-hook column above) can become available — but MCP presence

package/docs/featured-skills.md

@@ -1,6 +1,6 @@
 # Featured Skills
 
-A curated subset of the 278 skills. Three tiers, one per primary audience. Full catalog lives in [`dist/agent-src/skills/`](../dist/agent-src/skills/); see also [`docs/catalog.md`](catalog.md) for the complete index and [`docs/featured-commands.md`](featured-commands.md) for command-level highlights.
+A curated subset of the 281 skills. Three tiers, one per primary audience. Full catalog lives in [`dist/agent-src/skills/`](../dist/agent-src/skills/); see also [`docs/catalog.md`](catalog.md) for the complete index and [`docs/featured-commands.md`](featured-commands.md) for command-level highlights.
 
 > **Eval-gated messaging note.** Until `task bench --corpus non-dev` reports `selection_accuracy >= 0.60` (see `road-to-product-adoption.md` Phase 1), this page is documentation, not marketing. The entries below are the candidates the corpus tests against; their description quality is what the eval validates.
 
@@ -92,4 +92,4 @@ task lint-featured-skills
 
 CI runs this in `taskfiles/ci-fast.yml`. Stale entries (renamed / removed skill or command) fail the build. See [`scripts/lint_featured_skills.py`](../src/scripts/lint_featured_skills.py) for the matcher.
 
-→ Browse all 278 skills: [`dist/agent-src/skills/`](../dist/agent-src/skills/) · all 190 commands: [`dist/agent-src/commands/`](../dist/agent-src/commands/)
+→ Browse all 281 skills: [`dist/agent-src/skills/`](../dist/agent-src/skills/) · all 190 commands: [`dist/agent-src/commands/`](../dist/agent-src/commands/)

package/docs/getting-started-by-role.md

@@ -2,7 +2,7 @@
 
 > Pick the entry that matches what you do day-to-day. Each section names the three skills you will reach for first and shows whether MCP (no terminal) or CLI (terminal) is the simpler install path for that role.
 
-`agent-config` ships 278 skills, 105 governed rules, and 190 commands. You do not need all of them. Each role below filters to the slice that pays back in week one; the rest stays available and shows up on demand when a task references it.
+`agent-config` ships 281 skills, 107 governed rules, and 190 commands. You do not need all of them. Each role below filters to the slice that pays back in week one; the rest stays available and shows up on demand when a task references it.
 
 > **Taglines at a glance →** [`docs/role-experiences.md`](role-experiences.md) — the one-line pitch per role experience, in one table.