@event4u/agent-config 9.7.0 → 9.8.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Bootstrap shim for the event4u agent-config suite. This plugin ships ONLY the dispatcher hooks plus one install-pointer skill — ALL content (skills, rules, commands) is installed via `npx -y @event4u/agent-config init`, which writes the file projection AND registers the same hooks in ~/.claude/settings.json. DEPRECATED as a content channel; kept so the marketplace listing stays discoverable and existing installs keep working hooks.",
-    "version": "9.7.0",
+    "version": "9.8.0",
     "keywords": [
       "agent-config",
       "skills",

package/CHANGELOG.md

@@ -18,6 +18,42 @@ Entry-shape contract: [`docs/contracts/CHANGELOG-conventions.md`](docs/contracts
 
 ### Added
 
+- **Internet-reach operator tooling** — upstream-tool health and install-pinning
+  discipline for the tools a reach recipe needs. The router skill this was
+  scoped around was **cancelled pre-authoring by its own benchmark gate**: the
+  pre-registered run returned 0/12 outright wins against the host's native web
+  tools (`band: stop`), so no skill, no triggers, no capability-area claim. The
+  null is published in [`docs/benchmark.md`](docs/benchmark.md) § internet-reach;
+  the decision is [ADR-126](docs/decisions/ADR-126-internet-reach-operator-tooling.md).
+  - `reach:doctor` — new read-only command: per-channel probe status,
+    `active_backend`, tier, lifecycle, and the exact **pinned** fix command for
+    the current platform when a backend is missing or broken. No writes, no
+    installs, no network (`--deep` is the explicit opt-in that makes one real
+    request per backend and still writes nothing).
+  - `src/config/reach-channels.yml` + `reach-channels.schema.json` — ordered
+    backend candidates per channel (swapping a backend is a config reorder, not
+    a code edit), the four-value lifecycle vocabulary reused from
+    `provider-lifecycle`, `last_verified` staleness metadata, and an install
+    pattern that **rejects** unpinned versions, `latest`/`main`/`HEAD` refs and
+    archive-URL install sources.
+  - `tool_probe` — five-state probe taxonomy (`ok`/`missing`/`broken`/`timeout`/
+    `error`) with stale-shim detection (resolvable shim, dead interpreter),
+    exit-126/127 mapping, timeout-only single retry, and per-channel error
+    isolation. Every spawn routes through `hardenedSpawnEnv()`.
+  - `check-reach-channels` + `check-reach-prescriptions` CI gates — pinning and
+    intake-record discipline is machine-checked, not an honour system; a
+    prescription that cannot be pinned does not ship.
+  - `check-reach-staleness` CI gate — offline: a channel unverified for >90 days,
+    a `deprecated` channel with no `replacement`, or a channel past its
+    `removal_after` date and still present fails the build.
+  - Registry trust is enforced at runtime, not just in CI: `reach:doctor` (incl.
+    `--registry <path>`) validates the registry against its schema and refuses to
+    probe on any violation (exit 2). `probe_args` is a flag-shaped **allowlist**
+    and `probe_cmd` must equal its backend `id`, so a registry entry can neither
+    smuggle a shell payload nor label a row with a binary other than the one that
+    ran — both closed by an adversarial pre-merge review, with permanent
+    regression fixtures.
+
 - **Doc-follows-code discipline** — deterministic, framework-agnostic mechanism
   so documentation is updated when code changes.
   - `downstream-changes` rule gains a first-class **Doc-Impact** obligation:
@@ -139,6 +175,114 @@ Entry-shape contract: [`docs/contracts/CHANGELOG-conventions.md`](docs/contracts
 > that forces a new era split (`# Era: 9.3.x`, etc.) — see
 > [`docs/contracts/CHANGELOG-conventions.md § Era splits`](docs/contracts/CHANGELOG-conventions.md).
 
+## [9.8.0](https://github.com/event4u-app/agent-config/compare/9.7.0...9.8.0) (2026-07-26)
+
+### Features
+
+* **proof:** publish what re-derives itself, and what it prevents ([8ba878f](https://github.com/event4u-app/agent-config/commit/8ba878f0bb2244b33ce57f3484d5c0d0f887a5e9))
+* **governance:** classify trust-boundary risk, measure before gating ([1421f82](https://github.com/event4u-app/agent-config/commit/1421f829ee58fe56a4c41a15c5f2e3925f17b5e9))
+* **claims:** add exec: evidence that re-runs the command ([081b9ed](https://github.com/event4u-app/agent-config/commit/081b9ed36e29e3bb9e665004c16f3db9f831a107))
+* **ci:** run the backstops rules declare, and baseline the five that were already red ([545d9cc](https://github.com/event4u-app/agent-config/commit/545d9ccd02cba430c8b5cb7c9b15fb0c9fe40463))
+* **proof:** read the same checked rows as failure modes, not just as comparisons ([d2196de](https://github.com/event4u-app/agent-config/commit/d2196de10a220300b2897a379bf419c89416c117))
+* **adr:** index the decisions filed outside the ADR directory, and stop auditing a hardcoded list ([2a2999a](https://github.com/event4u-app/agent-config/commit/2a2999a437f98fa94eae76638598923f0ba85bcd))
+* **claims:** see the figure shapes that actually ship, and refuse a qual claim as a licence for a number ([5d7b166](https://github.com/event4u-app/agent-config/commit/5d7b1666364bb227fc687704560c93ddfb5fad2f))
+* **host-integration:** config-root spawn flag + embed contract v1 ([a9f0038](https://github.com/event4u-app/agent-config/commit/a9f0038631ed97b815ab255d3a307a617423f091))
+* **skill:** gated-reach — ship-tier channels only ([88f03c3](https://github.com/event4u-app/agent-config/commit/88f03c349fd89ffa36ca642eeef4bb8cd31263a8))
+* **lint:** refuse nag phrasing in skill bodies ([004d696](https://github.com/event4u-app/agent-config/commit/004d696d3afae203e1581c63de979d0571031331))
+* **reach:** distinguish "installed" from "able to extract" in reach:doctor ([e012bf7](https://github.com/event4u-app/agent-config/commit/e012bf784d0544002ec86128cc2fb2d6805e44d0))
+* **reach:** read Reddit and single tweets credential-free ([9b89a34](https://github.com/event4u-app/agent-config/commit/9b89a34cf863167fda437f51ab54396f11229b60))
+* **adr:** name the condition that reopens a decision, and validate ADR frontmatter at all ([5315ca1](https://github.com/event4u-app/agent-config/commit/5315ca1a05cb110dec839083dc8ef61b5f4fad9e))
+* **subagents:** deliver the safety floor the contract already promised ([48ccf6a](https://github.com/event4u-app/agent-config/commit/48ccf6a10a45ba2ee2583a5dd3765ab0b8db9605))
+* **overrides:** a kernel rule may be tightened, never replaced ([7821e22](https://github.com/event4u-app/agent-config/commit/7821e2202e9a03d9b0f80f299374a9cad3969139))
+* **enforcement:** resolve what enforces each rule, instead of trusting the claim ([efc0fab](https://github.com/event4u-app/agent-config/commit/efc0fab2b8fc1bf181ba89ecc9f427312996dc56))
+* **reach:** mechanize the supply-chain and staleness discipline as CI gates ([3d1b0f6](https://github.com/event4u-app/agent-config/commit/3d1b0f6375ba0f193fa198817bfa145091deebb1))
+* **reach:** channel registry, five-state probe engine and read-only reach:doctor ([2cf6f04](https://github.com/event4u-app/agent-config/commit/2cf6f0406e3e82f955832698db556c7cba8887e2))
+* **reach:** pre-registered reach-vs-native benchmark, published as an honest null ([8238f8b](https://github.com/event4u-app/agent-config/commit/8238f8bf78ac3f5cd47ad6ffdc703bbd562a206f))
+* **code-graph:** code-intelligence skill + interop routing + host degradation (Phase 4) ([eabe48c](https://github.com/event4u-app/agent-config/commit/eabe48c49311278cfcb96ba3401b5240b4707261))
+* **code-graph:** PreToolUse code-graph nudge hook (Phase 4) ([6d674ee](https://github.com/event4u-app/agent-config/commit/6d674ee421581a72094d581d35fc429006f7f4b4))
+* **code-graph:** incremental --update + symlink-confinement fix (Phase 4) ([c0c846c](https://github.com/event4u-app/agent-config/commit/c0c846c222fc76bfcc685de96ae0dd0055a2fd38))
+* add doc-screenshot anonymization discipline (rule + skill + ADR-125) ([c3e4671](https://github.com/event4u-app/agent-config/commit/c3e4671fd7822976d1293632b3b1ee7d707034a5))
+* **code-graph:** source-agnostic query tier + detection (Phase 3) ([f5a0117](https://github.com/event4u-app/agent-config/commit/f5a0117a3445c4c3070f4432788a645cc2522f5a))
+* **code-graph:** native WASM tree-sitter extract+build engine (Phase 2) ([8d78fef](https://github.com/event4u-app/agent-config/commit/8d78fefd788c6da88516ccdcdfde6ca84e572938))
+* **adr-124:** land embedded-engine doctrine + reclassification sweep (Phase 0-1) ([e1db617](https://github.com/event4u-app/agent-config/commit/e1db617307d13de6d520b9aacc6aa0bb5472fb92))
+* **install:** restart/launch the GUI on a global (re)install ([fae7a6c](https://github.com/event4u-app/agent-config/commit/fae7a6c6ad60441e2df9d056b92cc083ca63940d))
+* secret-scan pre-flight in /commit, /commit:in-chunks, /pr:create ([ab69931](https://github.com/event4u-app/agent-config/commit/ab6993114bb57f6d8f2fea98ec4c2ec0e82366e7))
+* secret-vcs-guard rule + secrets-management runtime guard ([9426f7e](https://github.com/event4u-app/agent-config/commit/9426f7e175b6b1325a4989eb07f709c8d9090bbe))
+* secret detector library + CI leak-scan gate ([3168244](https://github.com/event4u-app/agent-config/commit/316824447b277f966dfe194e0c7c6741121b7e9f))
+
+### Bug Fixes
+
+* **roadmaps:** inline the council convergence instead of linking the transcript ([c47d9fc](https://github.com/event4u-app/agent-config/commit/c47d9fc0f8e390a8edce2a30d3dd8c5350ae0fd1))
+* **docs:** replace stale 3.2.0 registry submission body and guard the file ([b393514](https://github.com/event4u-app/agent-config/commit/b393514dfa2a891ae24294d43155fa080ca115cd))
+* **ci:** give the backstop gates their baseline, and stop an empty scan reading as clean ([69083f5](https://github.com/event4u-app/agent-config/commit/69083f577975c0de1d9535b4b45c27f475a676d7))
+* **claims:** derive the denominator, and stop citing a gate that does not run ([89049f1](https://github.com/event4u-app/agent-config/commit/89049f1db36d63e33c7bb4f4a80712f3f2f72556))
+* **enforcement:** say which build — a taskfile-named validator is not a CI gate ([7a87271](https://github.com/event4u-app/agent-config/commit/7a87271cce6b0cabeb664ccf890acd1f0335a0e7))
+* **ci:** regenerate docs/proof.md and stop tracking a per-run eval artifact ([e8973c7](https://github.com/event4u-app/agent-config/commit/e8973c784513e33d7a0eb8e43d55c4a46b446a17))
+* **claims:** the witness-sweep fixture encoded the bug it was testing ([b7b8621](https://github.com/event4u-app/agent-config/commit/b7b8621966d82f7f0cda87838974f1066258a6ec))
+* **claims:** correct three shipped numbers, one of them understated by 3x ([2c52959](https://github.com/event4u-app/agent-config/commit/2c529590bce9ccb8cdabb1835f01670d7f60140a))
+* **ci:** three self-inflicted reds — my own schema, my own legacy path, my own hand-edit ([7945f6c](https://github.com/event4u-app/agent-config/commit/7945f6cd74640a8f401451896c7a8c9cadce9dfd))
+* **enforcement:** satisfy noUncheckedIndexedAccess in the two new scripts ([6501cce](https://github.com/event4u-app/agent-config/commit/6501ccebb757dd482dbd69bd5b784db447080e4a))
+* **output-discipline:** wire the linter the rule already claimed was wired ([d996c6d](https://github.com/event4u-app/agent-config/commit/d996c6d7372add7e9b738bca2064078bbbc4a958))
+* **kernel:** single-source the kernel list, and point the slow-rollout gate at a directory that exists ([676d74f](https://github.com/event4u-app/agent-config/commit/676d74f67d8db05d9f404e7a17d43172a2786bb1))
+* **reach:** close the content-echo class at all four sites, not three ([17e806d](https://github.com/event4u-app/agent-config/commit/17e806d37af0894908f9b12a5044dc7c1fb1d51c))
+* **reach:** confine credential_path, refuse non-files, and name what --deep consents to ([ffd02d0](https://github.com/event4u-app/agent-config/commit/ffd02d0d33b85f5e70de442d1c8dc4d5208b4c50))
+* **reach:** redact echoed file content, unify error sanitization, document the gate boundaries ([52a1ded](https://github.com/event4u-app/agent-config/commit/52a1ded5314c99a51414ad3b6f44a60177ce40e5))
+* **settings:** declare hooks.code_graph.enabled in the Zod settings schema ([ef475ce](https://github.com/event4u-app/agent-config/commit/ef475ce39a0e937f1f6cbfe9ed544633a789c969))
+* **proof:** regenerate proof.md after code-intelligence skill-count bump ([8ad88c8](https://github.com/event4u-app/agent-config/commit/8ad88c82eee0252d903c9efb93b62e380a6acba5))
+* sync settings Zod schema + regenerate proof/capabilities for screenshots config ([4812a6e](https://github.com/event4u-app/agent-config/commit/4812a6e232c7323695faf6a90328b13b2e48bbe0))
+* **proof:** regenerate proof.md after comparison.yaml row-1 rewording ([f36f583](https://github.com/event4u-app/agent-config/commit/f36f583c1aab82da7171e4c9f3f28306b5e1345a))
+* **roadmap:** unlink future reclassification-doc path in sequencing plan ([d74b4b0](https://github.com/event4u-app/agent-config/commit/d74b4b060cb01569c47615822b09ed2f055a2474))
+* **review:** reclassify MCP server B, machine-visible partial supersession ([1b2ed21](https://github.com/event4u-app/agent-config/commit/1b2ed21046a6c904d435dd48472f512477436cad))
+* **install:** make postinstall_gui self-contained (prepack-check) ([54a77b1](https://github.com/event4u-app/agent-config/commit/54a77b1bf981053f7e778ec2e6643637f608c313))
+* widen check_secret_leak opts types for exactOptionalPropertyTypes ([593dfab](https://github.com/event4u-app/agent-config/commit/593dfab595be8c8f5cc722f038e8e60fcdb2609b))
+* **release:** make the tag-workflow dispatch non-fatal + document actions:write ([d47949e](https://github.com/event4u-app/agent-config/commit/d47949e1357e5b4794b442c3b69fd84c999d23fa))
+
+### Documentation
+
+* **roadmaps:** record adoption progress and add two new roadmaps ([7af5375](https://github.com/event4u-app/agent-config/commit/7af537591d3628d4a2285553c41adcdf5e23e734))
+* **readme:** reorder the opening to lead with the wedge, not the catalog ([ab66da8](https://github.com/event4u-app/agent-config/commit/ab66da8e968a540528fffca05ce65184c0817740))
+* **adr:** record the cut as ADR-128, and archive the roadmap ([b365e90](https://github.com/event4u-app/agent-config/commit/b365e907461312f5e71e502de21333b10a211655))
+* **roadmap:** archive road-to-wiring-truth, complete ([aaafb9e](https://github.com/event4u-app/agent-config/commit/aaafb9e7543b9b4a75f40b09805725dc437ca564))
+* **roadmap:** archive road-to-number-truth, complete ([a12bbae](https://github.com/event4u-app/agent-config/commit/a12bbae9d83e60531a87b69fd135c37cbb02de8a))
+* **contracts:** write the local-server-ports + host-integration contract ([610e539](https://github.com/event4u-app/agent-config/commit/610e539538bac8a914ce28a2b4f9c9ef91165b61))
+* **roadmaps:** track the AC host-integration roadmaps + landed status ([34fcc27](https://github.com/event4u-app/agent-config/commit/34fcc271fe9eda5d24d8ee2a3260cdfbddad5722))
+* **roadmap:** close gated-reach, spawn the YouTube follow-up, park five successors ([530917a](https://github.com/event4u-app/agent-config/commit/530917a3a1c4be5c514fe4eb507dea83a65b4b53))
+* register the gated-reach claim, comparison row, and amend ADR-126 ([bb0b263](https://github.com/event4u-app/agent-config/commit/bb0b263292236a623e7cb71d2a9832f1e090cc3a))
+* **bench:** publish the gated-reach outcomes, ships and parks alike ([5ca8930](https://github.com/event4u-app/agent-config/commit/5ca89304c517b91d2d3950213c835e6336ef5d57))
+* **reach:** operator prescriptions for platforms the host cannot fetch ([844bb1b](https://github.com/event4u-app/agent-config/commit/844bb1b3cfa3633c2e4f383496ae04393ea15a48))
+* **roadmap:** archive road-to-enforcement-proof, complete ([a590aca](https://github.com/event4u-app/agent-config/commit/a590aca449b9aa0a186d4739c9931f2b46458fcf))
+* **proof:** publish both numbers, including the unflattering one ([eabe545](https://github.com/event4u-app/agent-config/commit/eabe545965648adbe4637f4b6f80ea3dcbc5de46))
+* **reach:** make Reddit ranking + thread structure the goal — and it stays credential-free ([4c3b3cb](https://github.com/event4u-app/agent-config/commit/4c3b3cbafba3087078ff3a2ff0f0509e36dc29e1))
+* **reach:** roadmap for credential-free gated reach — Reddit, single tweets, transcripts ([ff4b40c](https://github.com/event4u-app/agent-config/commit/ff4b40c83a8925fabfbf9c87ae29af092bcc1f0a))
+* **reach:** correct my own overstatement about what the witness contains ([0e46437](https://github.com/event4u-app/agent-config/commit/0e46437e6377b863245e769cce9c0721e39a4698))
+* **reach:** record all four council divergences, and give both accepted costs a re-entry point ([7f85378](https://github.com/event4u-app/agent-config/commit/7f853788973a3fcfac61e34866047d8704d61bd6))
+* **reach:** ADR-126, archived roadmap, comparison row and maintenance log ([4bfc9da](https://github.com/event4u-app/agent-config/commit/4bfc9da38cd809465713e8544b953e38781594b4))
+* **roadmap:** add native-code-intelligence roadmap + engine queue ([7c7ac11](https://github.com/event4u-app/agent-config/commit/7c7ac1149b8715794be0baac5b3285e514fb9b65))
+* **adr:** propose ADR-124 embedded-engine doctrine ([d8c90a5](https://github.com/event4u-app/agent-config/commit/d8c90a52397a048b52abf17575f6d67d298b364b))
+* **roadmap:** sync dashboard for archived Starlight roadmap ([d30846c](https://github.com/event4u-app/agent-config/commit/d30846c1299ef9784ea33a8572f830a0ae1b571f))
+* **roadmap:** complete + archive Starlight project-docs roadmap ([4c7b91f](https://github.com/event4u-app/agent-config/commit/4c7b91f407f1238ffc83c1700f444e136c476400))
+* **roadmap:** add Starlight project-docs roadmap ([f63e87f](https://github.com/event4u-app/agent-config/commit/f63e87f3ebc2cc53e2ceccb6a43591fd394aa90e))
+* **site:** add setup, configuration, CLI and agent-command docs ([7c05e68](https://github.com/event4u-app/agent-config/commit/7c05e68fdc27c391c0882d2f2d0284bb3f3f9d8f))
+* **site:** restyle docs site to the data-helpers look ([ef0e7a0](https://github.com/event4u-app/agent-config/commit/ef0e7a05de293d49c7f6fb474c40f157f621de13))
+* document the secret-in-VCS guardrail (threat model + SECURITY) ([e10e316](https://github.com/event4u-app/agent-config/commit/e10e3160bb07b6457602b2c2ee70f2215a66dfb5))
+
+### Tests
+
+* **bench:** gated-reach — pre-registration, rows, per-channel verdict ([8233aed](https://github.com/event4u-app/agent-config/commit/8233aedd50c80156a9d8996967e1fd2a7db70109))
+* **reach:** drop the witness instrument that watched shared state, and say what that costs ([1be7ab9](https://github.com/event4u-app/agent-config/commit/1be7ab98373f20cbfd0048184cc62a0c93de1151))
+* **reach:** cover the sanitized error path, the export gate and the win32 skip ([3b5a47a](https://github.com/event4u-app/agent-config/commit/3b5a47a5c30d0968f2631924c813d3c6b13884d2))
+* **reach:** the read-only witness parses the AST instead of grepping the source ([e54f22d](https://github.com/event4u-app/agent-config/commit/e54f22d994736c3e6cbb37390bc4b843975fa05e))
+
+### Chores
+
+* **reports:** regenerate the originality audit, stale on main ([aef5b53](https://github.com/event4u-app/agent-config/commit/aef5b53bbaf918a6b849060063e6c40196ab5dd4))
+* regenerate drifted originality report (pre-push consistency sync) ([66c7f04](https://github.com/event4u-app/agent-config/commit/66c7f04afe9005b91c07457902edcf2ee0cf3a78))
+* **test:** remove two orphans the depythonization left in the linter test ([e800c8e](https://github.com/event4u-app/agent-config/commit/e800c8e8627e26388de29c2b3e38b95620932b64))
+* **regen:** sync skill counts + meta-pack membership after code-intelligence ([0775e14](https://github.com/event4u-app/agent-config/commit/0775e148c1fbd61da13f9ad5646e4f8ef7bfe324))
+* **roadmap:** park native-code-intelligence in later/ (Phases 0-4 done, 5-6 gated) ([f7b3c2f](https://github.com/event4u-app/agent-config/commit/f7b3c2f63339efb81b497e6eeda05a3e843171d7))
+* regenerate docs/proof.md for the +1 rule count ([620614c](https://github.com/event4u-app/agent-config/commit/620614c901b1c7971c8c55d97477c74e5b2f2ba2))
+* regenerate dist projections + counts, archive completed roadmap ([55052c9](https://github.com/event4u-app/agent-config/commit/55052c941be45cea1d4dfc65fc048a0c8f450958))
+
 ## [9.7.0](https://github.com/event4u-app/agent-config/compare/9.6.0...9.7.0) (2026-07-21)
 
 ### Features

package/README.md

@@ -4,17 +4,17 @@
 
 [![Smoke](https://github.com/event4u-app/agent-config/actions/workflows/smoke.yml/badge.svg)](https://github.com/event4u-app/agent-config/actions/workflows/smoke.yml) [![Public install smoke (3 OS × 2 Node)](https://github.com/event4u-app/agent-config/actions/workflows/smoke-public-install.yml/badge.svg)](https://github.com/event4u-app/agent-config/actions/workflows/smoke-public-install.yml) [![npm](https://img.shields.io/npm/v/@event4u/agent-config?style=flat-square&label=npm&color=orange)](https://www.npmjs.com/package/@event4u/agent-config) [![agent-config MCP server](https://glama.ai/mcp/servers/event4u-app/agent-config/badges/score.svg)](https://glama.ai/mcp/servers/event4u-app/agent-config)
 
-[![Skills](https://img.shields.io/badge/Skills-278-orange?style=flat-square)](dist/agent-src/skills/) [![Rules](https://img.shields.io/badge/Rules-105-orange?style=flat-square)](dist/agent-src/rules/) [![Commands](https://img.shields.io/badge/Commands-190-orange?style=flat-square)](dist/agent-src/commands/) [![Guidelines](https://img.shields.io/badge/Guidelines-101-orange?style=flat-square)](docs/guidelines/) [![Personas](https://img.shields.io/badge/Personas-29-orange?style=flat-square)](dist/agent-src/personas/) [![Advisors](https://img.shields.io/badge/Advisors-5-orange?style=flat-square)](dist/agent-src/personas/advisors/)
-
-> **Choose your experience — developer · founder · content · agency · finance · ops. Add packs. Get a focused command set, not a 500-artefact dump.** Bring your own AI provider.
-
 **Try it in 30 seconds** — drop one read-only subagent into any repo and watch it gate "done": `@production-validator check this branch is actually done`. No wizard, no lock-in, nothing else installed — the [30-second wedge ↓](#quickstart) is the whole first step. Start at the proof, not the catalog: **[event4u-app.github.io/agent-config/proof/](https://event4u-app.github.io/agent-config/proof/)**.
 
 ![The trust surface running green — every "verify it yourself" command from a real, CI-re-executed run](docs/media/proof-demo.gif)
 
 **Every public claim in this README is machine-checked — [verify it yourself](docs/proof.md).** In a market that runs on unbacked headline numbers, this one binds each claim to resolvable evidence or fails its own build.
 
-**A deep library of skills, commands and governed rules** — plus a capability router that loads the right skill on intent and multi-agent orchestration with consensus review. The whole layer is compiled into 7+ host agents (Claude Code, Cursor, Augment, Cline, Windsurf, Copilot, Gemini) with **zero runtime daemon**.<!-- claim:no-runtime-daemon --> Six role-shaped entry paths sit on top, so any host becomes a reliable team member — without locking you to a single model or vendor.
+> **Choose your experience — developer · founder · content · agency · finance · ops. Add packs. Get a focused command set, not a 500-artefact dump.** Bring your own AI provider.
+
+[![Skills](https://img.shields.io/badge/Skills-281-orange?style=flat-square)](dist/agent-src/skills/) [![Rules](https://img.shields.io/badge/Rules-107-orange?style=flat-square)](dist/agent-src/rules/) [![Commands](https://img.shields.io/badge/Commands-190-orange?style=flat-square)](dist/agent-src/commands/) [![Guidelines](https://img.shields.io/badge/Guidelines-101-orange?style=flat-square)](docs/guidelines/) [![Personas](https://img.shields.io/badge/Personas-29-orange?style=flat-square)](dist/agent-src/personas/) [![Advisors](https://img.shields.io/badge/Advisors-5-orange?style=flat-square)](dist/agent-src/personas/advisors/)
+
+**A deep library of skills, commands and governed rules** — plus a capability router that loads the right skill on intent and multi-agent orchestration with consensus review. The whole layer is compiled into **20 host agents** — of 23 detected, 3 being export-only<!-- claim:host-agent-count --> (Claude Code, Cursor, Augment, Cline, Windsurf, Copilot, Gemini CLI, Codex, Continue, Zed, JetBrains, Aider and more) — with **zero runtime daemon**.<!-- claim:no-runtime-daemon --> Six role-shaped entry paths sit on top, so any host becomes a reliable team member — without locking you to a single model or vendor.
 
 ### What's different
 

package/dist/agent-src/commands/commit/in-chunks.md

@@ -70,6 +70,14 @@ Splitting rules:
 
 Generate commit messages per [`commit-conventions`](../../rules/commit-conventions.md).
 
+### 3b. Secret-leak pre-flight — MANDATORY, not autonomy-lifted
+
+Run `./scripts-run src/scripts/check_secret_leak`. A high-confidence hit is a
+safety surface: **STOP even under this autonomous flow** (autonomy never lifts
+it), hand to [`secret-vcs-guard`](../../rules/secret-vcs-guard.md) — show the
+match, ask, offer the alternative. Never auto-commit a secret; never silently
+strip one.
+
 ### 4. Validate, then commit immediately
 
 Before staging anything, run the same `preview-on-error` validator as

package/dist/agent-src/commands/commit.md

@@ -79,6 +79,23 @@ If there are no uncommitted changes (staged or unstaged), report "Nothing to com
   - Are purely stylistic/formatting changes (separate from logic changes)
   - Are unrelated to the main change (e.g. config fix, unrelated typo)
 
+### 3b. Secret-leak pre-flight
+
+Before planning any commit, scan the changed set for credentials:
+
+```
+./scripts-run src/scripts/check_secret_leak
+```
+
+If it exits non-zero (a high-confidence secret in the diff or an untracked file),
+**STOP** — do not stage or commit. Hand control to the
+`.augment/rules/secret-vcs-guard.md` rule: show the match, ask via numbered
+options, and offer the tiered alternative (see
+`.augment/skills/secrets-management/SKILL.md`). Only proceed
+once the user resolves it (move to a store, or add an audited
+`# secret-allow` / `.secret-allow` entry for a confirmed false positive). Never
+silently commit a secret; never silently strip one.
+
 ### 4. Plan the commits
 
 For each logical group, determine the commit message following the commit conventions rule

package/dist/agent-src/commands/pr/create.md

@@ -53,6 +53,10 @@ Uses `/create-pr:description-only` to generate the PR content, then creates the
 - Verify the current branch is NOT the default branch (`main` / `master`).
 - Run `git status` — warn if there are uncommitted changes.
 - Run `git log origin/{default}..HEAD --oneline` to verify there are commits to push.
+- **Secret-leak pre-flight (MANDATORY before push):** run
+  `./scripts-run src/scripts/check_secret_leak`. On a high-confidence hit, STOP —
+  do not push; hand to `.augment/rules/secret-vcs-guard.md` (show, ask, offer the
+  alternative, rotate-first if already in history). Pushing publishes the secret.
 - If the branch has not been pushed yet, ask the user (in their language) whether to push.
 
 ### 1b. Freshness gate — MANDATORY before opening any PR

package/dist/agent-src/contexts/override-system.md

@@ -19,12 +19,58 @@ When an agent loads any skill, rule, command, guideline, or template:
 ```
 1. Load original from .augment/{type}/{name}
 2. Check agents/overrides/{type}/{name} exists?
-   ├── YES → Read Mode header
-   │   ├── extend  → Apply original FIRST, then layer override on top
-   │   └── replace → Skip original entirely, use override only
+   ├── YES → Is the target a KERNEL or safety-floor rule?
+   │   ├── YES → replace → REFUSE. Report it. Keep the original.
+   │   │         extend  → allowed ONLY with a registered exception (below)
+   │   └── NO  → Read Mode header
+   │             ├── extend  → Apply original FIRST, then layer override on top
+   │             └── replace → Skip original entirely, use override only
    └── NO  → Use original unchanged
 ```
 
+## The non-overridable class
+
+```
+A KERNEL OR SAFETY-FLOOR RULE MAY BE TIGHTENED, NEVER REPLACED OR RELAXED.
+A `replace`-MODE OVERRIDE ON ONE IS REFUSED AND REPORTED — NEVER SILENTLY APPLIED.
+AN `extend` ON ONE REQUIRES A REGISTERED, JUSTIFIED EXCEPTION.
+```
+
+The nine kernel rules — `agent-authority`, `ask-when-uncertain`, `commit-policy`,
+`direct-answers`, `language-and-tone`, `no-cheap-questions`,
+`non-destructive-by-default`, `scope-control`, `verify-before-complete` — plus
+anything carrying `tier: safety-floor`, are not replaceable. Dropping an empty
+file at `agents/overrides/rules/non-destructive-by-default.md` must not remove
+the Hard Floor.
+
+**Why not a blanket ban.** Legitimate tightening exists, and this package does
+it: its own `verify-before-complete` override adds a mandatory-Playwright clause
+for UI changes. Banning the name would forbid a change that makes the floor
+*stronger*. So direction matters, not identity — and since no linter can prove
+"relaxes" versus "legitimately narrows" from prose, `extend` is the machine-
+checkable proxy for tightening and the registry carries the human judgement.
+
+**The exception registry.** An `extend` override on a kernel or safety-floor rule
+requires an entry in `agents/overrides/kernel-exceptions.yml`:
+
+```yaml
+exceptions:
+  - rule: verify-before-complete
+    mode: extend
+    justification: "Ships a browser UI; code-only tests cannot prove what renders."
+    approved_by: maintainer
+```
+
+**Honest limit — read this before trusting the class.** This is a norm with a
+partial gate, and saying so is the point. The override layer is resolved by the
+*agent reading these instructions*, not by a loader, so an `extend` block that
+says "ignore everything above" is not mechanically detectable — and nothing here
+stops a consumer relaxing a rule through another channel (a persona file,
+host-level config, a direct instruction). What the gate does cover is this
+package's own authoring surface: a `replace`-mode kernel override, or an
+unregistered kernel exception, fails deterministically. Everything else is
+reported, not claimed as enforced.
+
 ## Directory Mapping
 
 ```
@@ -93,7 +139,9 @@ The original is loaded first. The override adds, modifies, or removes specific p
 
 ## Mode: replace
 
-The original is completely ignored. The override is the sole source of truth.
+The original is completely ignored. The override is the sole source of truth —
+**except for kernel and safety-floor rules, where `replace` is refused outright**
+(see "The non-overridable class" above).
 
 **Use when:**
 - The shared skill/rule fundamentally doesn't fit the project
@@ -101,6 +149,24 @@ The original is completely ignored. The override is the sole source of truth.
 
 **Best practice:** Must be self-contained and complete. No references to the original.
 
+**Note the update cost.** A whole-file replacement freezes that file at the
+version you forked it from: later fixes to the original — including security
+fixes — stop reaching you, silently, because your copy wins on name match
+forever. Prefer `extend`, which keeps the rest of the original in the update
+flow. This is the same silent-drift failure the deploy-tiering discussion names.
+
+## Citation obligation
+
+Every override carries, directly under its Mode header, one line naming what it
+overrides and why:
+
+```markdown
+> Overrides: verify-before-complete §Turn-completion — ships a browser UI; code-only tests cannot prove what renders.
+```
+
+Without it the layer is usable but not auditable: a reviewer six months later
+cannot tell an intentional narrowing from an accident. No reason, no override.
+
 ## Agent Behavior
 
 Agents **must** check for overrides before applying any shared resource:
@@ -111,6 +177,10 @@ Agents **must** check for overrides before applying any shared resource:
 4. Before reading a guideline → check `agents/overrides/guidelines/{lang}-{name}.md`
 5. Before using a template → check `agents/overrides/templates/{name}.md`
 
+**Before honouring an override on a rule, check the non-overridable class
+first.** A `replace` on a kernel or safety-floor rule is refused and reported to
+the user — it is never silently dropped and never silently applied.
+
 ## When to Create vs. When to Fix
 
 | Situation | Action |
@@ -155,7 +225,7 @@ When a project using this package wants to **optimize** a shared rule or skill:
 
 ### Anti-patterns
 
-- Keeping the override after upstream merge → → drift
+- Keeping the override after upstream merge → causes drift
 - Submitting only the condensed version → breaks source-of-truth workflow
 - Submitting project-specific behavior as universal improvement
 - Forgetting to create the PR → improvement stays siloed

package/dist/agent-src/rules/context-hygiene.md

@@ -12,6 +12,8 @@ routes_to:
   - "guideline:agent-infra/context-hygiene-mechanics"
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
+enforced_by:
+  - "hook:context-hygiene"
 ---
 
 # Context Hygiene

package/dist/agent-src/rules/doc-screenshot-hygiene.md

@@ -0,0 +1,97 @@
+---
+type: "auto"
+tier: "2a"
+description: "Screenshots for docs — anonymize sensitive data before shipping; data-bearing shots are human-gated (published egress); terminal/CLI/IDE screenshots forbidden"
+triggers:
+  - keyword: "screenshot"
+  - keyword: "screenshots"
+  - keyword: "screen capture"
+  - keyword: "screen grab"
+  - keyword: "admin panel screenshot"
+  - keyword: "dashboard screenshot"
+  - keyword: "docs site"
+  - keyword: "Starlight"
+  - phrase: "add a screenshot"
+  - phrase: "screenshot for the docs"
+  - phrase: "screenshot in the readme"
+  - phrase: "embed an image in the docs"
+  - phrase: "put a screenshot"
+  - phrase: "generate a docs site"
+  - phrase: "capture the ui"
+  - path_prefix: "docs/media/"
+routes_to:
+  - "skill:screenshot-hygiene"
+applies_to_user_types:
+  - "all"
+workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
+packs: [meta]
+---
+
+# Doc-Screenshot Hygiene
+
+Agents may create screenshots for documentation when genuinely useful (a docs
+site, feature docs, a README visual) and embed them. But a screenshot is an
+opaque artifact that can carry **real PII, secrets, or revealing local paths**
+straight into shipped, hosted, committed docs — an irreversible published egress.
+This rule governs the anonymization discipline before any screenshot ships. Full
+workflow: [`screenshot-hygiene`](../skills/screenshot-hygiene/SKILL.md).
+
+## The Iron Law
+
+```
+A SHIPPED SCREENSHOT WITH UNREDACTED SENSITIVE DATA IS AN
+IRREVERSIBLE PUBLISHED EGRESS. NEVER SHIP ONE.
+ANONYMIZE BEFORE IT SHIPS — REAL NAMES, ADDRESSES, BIRTHDATES, TOKENS,
+SECRETS, REAL EMAILS, IDENTITY-REVEALING LOCAL PATHS.
+DETECTION IS A HELPER, NEVER A CLEARANCE. THE GATE IS HUMAN CONFIRMATION.
+A DATA-BEARING SCREENSHOT EMBED IS GATED PER non-destructive-by-default
+(THIS-TURN CONFIRMATION). TERMINAL / CLI / IDE SCREENSHOTS ARE FORBIDDEN.
+WHEN UNCERTAIN → REDACT OR REFUSE. NEVER SHIP-AND-HOPE.
+```
+
+## The anonymization taxonomy
+
+**Always redact / refuse (sensitive):** real person's name, postal address,
+birthdate, phone; passwords, API tokens, secrets, cookies, bearer tokens,
+private keys; real email addresses (anything not `@example.{com,org,net}` / a
+fake-data domain); absolute local paths revealing a real identity
+(`/Users/<realname>/…`); client / customer / project identifiers; internal
+hostnames (`*.internal`); anything GDPR-sensitive; aggregate counts or data
+tells that reveal real users.
+
+**Allowed (no redaction):** well-known fake data (Max Mustermann, Musterstraße,
+`@example.com`); the maintainer's OWN public handle shown as a username (e.g.
+a handle in an admin panel — it is already public), and a path rooted at that
+public handle. The maintainer's **real name is never allowed**, even co-located
+with the handle. The safe set is `screenshots.identity_allowlist` (default
+empty → every identity is human-decided).
+
+## Risk tiers — symmetric friction
+
+- **Illustrative / no data** (architecture diagrams, logos, icons, wireframes,
+  placeholder-only UI): embed with a one-line justification. Low friction.
+- **Data-bearing** (dashboards, admin panels, forms/lists with content, anything
+  showing real-looking data): run the hygiene workflow, then **this-turn human
+  confirmation before embed** (per [`non-destructive-by-default`](non-destructive-by-default.md)).
+- **Terminal / CLI / IDE output**: **forbidden** as screenshots (highest leak
+  vector — absolute paths, env tokens). Use a text code block with text
+  redaction. Set `screenshots.forbid_terminal_capture` (default `true`).
+
+## When it fires — and when NOT
+
+**Fires** when creating/embedding a screenshot into documentation (docs site,
+README, feature docs) or when a screenshot lands under `docs/media/`.
+
+**Does NOT fire** on: image *generation* (see `media-governance-routing`,
+`image-likeness-and-rights`); a user-supplied screenshot used only as a design
+spec to compare against (see `design-fidelity`, `cross-source-consistency`);
+non-doc surfaces.
+
+## See also
+
+- [`screenshot-hygiene`](../skills/screenshot-hygiene/SKILL.md) — the decide → capture → detect → redact → audit → embed workflow + the human-gate checklist.
+- [`non-destructive-by-default`](non-destructive-by-default.md) — the published-egress Hard Floor a data-bearing embed routes into.
+- [`domain-safety-pii`](domain-safety-pii.md) — the sibling PII rule for text surfaces (drafts / logs / exports); screenshots are the visual surface.
+- [`lethal-trifecta-guard`](lethal-trifecta-guard.md) — a screenshot is the private-data + egress legs; the human gate is the egress control.
+- [`readme-writing`](../skills/readme-writing/SKILL.md) — flags unrequested data-bearing screenshots.
+- [`image-analyser`](../skills/image-analyser/SKILL.md), [`image-editing`](../skills/image-editing/SKILL.md) — the OCR-detect / region-redact helpers.

package/dist/agent-src/rules/domain-safety-pii.md

@@ -164,3 +164,4 @@ PreToolUse hook — see `agents/settings/contexts/legal-privilege-probe.md`.
 - `skill:logging-monitoring`, `skill:secrets-management` — technical surfaces.
 - `domain-safety-disclaimer` — companion advisory rule.
 - `domain-safety-retention` — companion retention rule.
+- `doc-screenshot-hygiene` — the visual sibling: PII inside a **screenshot** shipped into docs (this rule covers text drafts / logs / exports, not images).

package/dist/agent-src/rules/external-code-graph-interop.md

@@ -23,15 +23,20 @@ packs: [meta]
 Some repos commit a pre-built code-intelligence index — a `graph.json`-shaped
 artifact or a SCIP index (`index.scip`, `*.scip`). When one exists, it already
 answers "who calls X", "where is Y used", "what does this import" far more
-precisely than a fresh `grep`. This suite is an **orchestrator, not a
-competitor**: query the existing index first.
+precisely than a fresh `grep`. This suite is an **orchestrator first, owner
+where it wins** (ADR-124): query a consumer-shipped index when it is present
+and fresh; where none is shipped or ours is measurably better, the suite's own
+native code-graph engine (default-off, benchmark-gated) covers the gap. Either
+way — query first, grep as fallback, and name which source answered.
 
 ## The rule
 
 ```
 REPO SHIPS A CODE-GRAPH INDEX (graph.json-shaped OR a SCIP index)
 → QUERY IT FIRST FOR CODEBASE-STRUCTURE QUESTIONS. GREP IS THE FALLBACK,
-NOT THE FIRST MOVE. NEVER REBUILD WHAT THE INDEX ALREADY ANSWERS.
+NOT THE FIRST MOVE. NEVER REBUILD A FRESH CONSUMER-SHIPPED INDEX.
+NO FRESH INDEX SHIPPED → THE NATIVE ENGINE MAY BUILD ONE (ADR-124); STILL
+GREP-FALLBACK FOR WHAT THE GRAPH DOES NOT ANSWER, AND SAY WHICH SOURCE ANSWERED.
 ```
 
 ## When it fires
@@ -58,6 +63,11 @@ AND the repo contains a detectable index:
 
 ## See also
 
+- [`code-intelligence`](../skills/code-intelligence/SKILL.md) — the executable
+  routing skill: `code_graph detect|query|affected|path` over the native engine
+  or a consumer-shipped index, grep as the stated fallback. On hook-capable
+  hosts the PreToolUse `code-graph` nudge surfaces this once per session; on
+  instruction-file hosts this rule is the surface.
 - [`discovery_graph`](../scripts/discovery_graph.ts) — this suite's OWN artefact
   relation-graph (`affected`/`explain`); the external code-graph is the
   *source-code* analogue this rule defers to for code questions.

package/dist/agent-src/rules/framework-neutrality-in-generic-skills.md

@@ -32,6 +32,8 @@ routes_to:
   - "guideline:agent-infra/framework-neutrality-patterns"
 workspaces: [agent-config-maintainer]
 packs: [meta]
+enforced_by:
+  - "validator:src/scripts/lint_framework_leakage.ts"
 ---
 
 # framework-neutrality-in-generic-skills

package/dist/agent-src/rules/git-history-discipline.md

@@ -28,6 +28,8 @@ routes_to:
   - "skill:git-workflow"
 workspaces: [engineering]
 packs: [engineering-base]
+enforced_by:
+  - "hook:block-no-verify"
 ---
 
 # Git History Discipline

package/dist/agent-src/rules/language-and-tone.md

@@ -9,6 +9,8 @@ validator_ignore:
     reason: "Rule scopes the .md-English mandate to the authoring tree."
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
+enforced_by:
+  - "validator:src/scripts/check_md_language.ts"
 ---
 
 # Language and Tone

package/dist/agent-src/rules/lethal-trifecta-guard.md

@@ -14,6 +14,8 @@ triggers:
   - phrase: "read the file and post"
 workspaces: [engineering]
 packs: [engineering-base]
+enforced_by:
+  - "validator:src/scripts/lint_skill_frontmatter_safety.ts"
 ---
 
 # Lethal-Trifecta Guard
@@ -84,3 +86,4 @@ backstop.
 - [`non-destructive-by-default`](non-destructive-by-default.md) — the human-in-the-loop egress floor.
 - [`threat-modeling`](../skills/threat-modeling/SKILL.md) — abuse-case enumeration.
 - [`domain-safety-pii`](domain-safety-pii.md) § Surface 4 — legal privilege markers extend this egress gate (legal pack); a privileged document on an outbound path is blocked pending explicit confirmation.
+- [`doc-screenshot-hygiene`](doc-screenshot-hygiene.md) — a screenshot embedded into shipped docs is private-data + egress on one path; the human gate on a data-bearing embed is the egress control.

package/dist/agent-src/rules/media-governance-routing.md

@@ -28,6 +28,8 @@ validator_ignore:
     reason: "Rule contrasts project-local placement with the .agent-src.uncondensed/rules/ alternative — mentioning the path is the argument."
 workspaces: [agent-config-maintainer, engineering, gtm]
 packs: [ai-image, ai-video]
+enforced_by:
+  - "validator:src/scripts/lint_media_policy_linkage.ts"
 ---
 
 # Media Governance Routing

package/dist/agent-src/rules/minimal-safe-diff.md

@@ -13,6 +13,8 @@ routes_to:
   - "guideline:agent-infra/minimal-safe-diff-mechanics"
 workspaces: [engineering]
 packs: [engineering-base]
+enforced_by:
+  - "hook:minimal-safe-diff"
 ---
 
 # Minimal Safe Diff

package/dist/agent-src/rules/no-roadmap-references.md

@@ -19,6 +19,9 @@ validator_ignore:
     reason: "Rule contrasts the authoring tree with transient layers."
 workspaces: [agent-config-maintainer]
 packs: [meta]
+enforced_by:
+  - "validator:src/scripts/check_no_roadmap_refs.ts"
+  - "validator:src/scripts/check_council_references.ts"
 ---
 
 # No Transient References from Stable Artifacts