@event4u/agent-config 9.7.0 → 9.8.0

package/dist/ui/index.html

@@ -8,17 +8,26 @@
         <script>
             // Theme boot — set data-theme BEFORE first paint so there is no
             // flash of the wrong theme (road-to-setup-experience § Phase 4.2).
-            // Persisted override in localStorage wins; otherwise follow the OS.
+            // Precedence: a host-supplied `?theme=light|dark` boot query wins
+            // (reciprocal-ecosystem embed contract — the host owns the theme),
+            // then a persisted localStorage override, then the OS preference.
             (function () {
+                var query = null;
+                try {
+                    var q = new URLSearchParams(window.location.search).get('theme');
+                    if (q === 'light' || q === 'dark') query = q;
+                } catch (e) { /* older engine */ }
                 var stored = null;
                 try { stored = localStorage.getItem('agent-config-theme'); } catch (e) { /* private mode */ }
-                var theme = stored === 'light' || stored === 'dark'
-                    ? stored
-                    : (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light');
+                var theme = query
+                    ? query
+                    : stored === 'light' || stored === 'dark'
+                        ? stored
+                        : (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light');
                 document.documentElement.setAttribute('data-theme', theme);
             })();
         </script>
-      <script type="module" crossorigin src="/assets/index-BiEZiZ31.js"></script>
+      <script type="module" crossorigin src="/assets/index-CrmZ34Rg.js"></script>
       <link rel="stylesheet" crossorigin href="/assets/index-BPFMZWUs.css">
     </head>
     <body>

package/docs/CLAIMS.md

@@ -32,11 +32,36 @@
 - last_verified: <YYYY-MM-DD>
 ```
 
-**Evidence-pointer grammar (v1):**
+**Evidence-pointer grammar (v2):**
 
 - `path/to/file.md` or `path/to/file.md:42` — the repo file exists (line advisory).
 - `path/to/file.md#substring` — the file exists AND contains `substring`.
 - `https://… (YYYY-MM-DD)` — external cite carrying a dated stamp (not fetched in CI).
+- `exec:<command> -> <exit-code>` — the command **re-runs** and its exit code
+  must match. The only form that can tell a live claim from a stale one.
+
+**Why the fourth form exists.** The first three are existence checks. A claim
+reading "the suite is green" whose pointer resolves to a report nobody
+regenerated stays `backed` indefinitely — the pointer resolves, the claim is
+false. `exec:` re-derives the claim and lets the exit code carry the verdict.
+
+**Where `exec:` runs, and where it does not.** Re-execution happens in CI only.
+Locally the gate is read-only and reports `UNVERIFIED — re-execution is CI-only,
+skipped locally`; it never runs a command in a consumer's checkout. The static
+half — is the pointer well-formed, is the command allowlisted — is checked
+everywhere, because a bad pointer is a defect in the ledger rather than a
+property of the machine.
+
+**What `exec:` cannot cover.** Only claims whose exit code *is* the verdict. A
+figure resting on a paid model run, a stochastic benchmark, or a prose contract
+cannot use this form; those stay on a pointer and are listed as
+unfalsifiable-by-machine in [`proof.md`](proof.md) rather than quietly omitted.
+
+The allowlist is a set of argv prefix tuples in
+[`src/scripts/_lib/exec_evidence.ts`](../src/scripts/_lib/exec_evidence.ts) —
+never a regex over a command string, because a regex over shell text is the
+classic bypass. Every argument after the matched prefix is re-checked for shell
+metacharacters and repo escape, including the right-hand side of `--flag=value`.
 
 ---
 
@@ -52,7 +77,7 @@
 ### claim: shipped-artifacts-hidden-instruction-scanned
 - claim: Every artifact the package ships — source AND the condensed projection that reaches consumers — is machine-scanned in CI for hidden-Unicode, mixed-script-confusable, and instruction-smuggling payloads (the rules-file-backdoor class); a finding blocks the release before `npm publish`, not just the merge.
 - kind: qual
-- evidence: .github/workflows/publish-npm.yml#lint_agent_security
+- evidence: exec:lint_agent_security -> 0
 - status: backed
 - last_verified: 2026-07-09
 
@@ -87,21 +112,21 @@
 ### claim: eval-coverage-ratcheted
 - claim: Behavioural-eval coverage is measured per tier and CI-ratcheted so it can only rise; the current coverage and its gap are published, never implied as "264 evaluated skills".
 - kind: qual
-- evidence: src/scripts/skill_eval_coverage.ts#checkRatchet
+- evidence: exec:skill_eval_coverage --check -> 0
 - status: backed
 - last_verified: 2026-07-08
 
 ### claim: domain-soundness-scoped
 - claim: The non-coding domain skills (finance/founder/ops/content) are forged on TS/PHP and labeled unvalidated until they pass a sourced domain-truth fixture; no public prose implies proven domain correctness, and the validated count is CI-ratcheted.
 - kind: qual
-- evidence: src/scripts/domain_soundness_status.ts#checkRatchet
+- evidence: exec:domain_soundness_status --check -> 0
 - status: backed
 - last_verified: 2026-07-08
 
 ### claim: domain-soundness-validated-count
 - claim: The validated non-coding domain-skill count is pinned and CI-ratcheted at a maintainer-set floor (9 of 20 default-surface skills carry a sourced `evals/domain-truth.json` fixture at pin time, 2026-07-11 — 5 deterministic, keys from cited formulas; 4 rubric, criteria matching a named external practice); the floor only rises via a maintainer `--write-floor` after a new sourced fixture lands.
 - kind: quant
-- evidence: internal/evals/domain-soundness-floor.json#validated
+- evidence: exec:domain_soundness_status -> 0
 - status: backed
 - last_verified: 2026-07-11
 
@@ -119,17 +144,10 @@
 - status: backed
 - last_verified: 2026-07-09
 
-### claim: second-brain-retrieval-precision
-- claim: Removing the perfect-retrieval assumption, the substrate's REAL keyword retrieval recalls the needed decision into the top-5 under keyword-overlapping confusers (precision@5 9/9) and the model disambiguates it from the co-injected confusers — retrieval-on 27/27 vs no-memory 5/27 and vs equal-count placebo 5/27 (claude-haiku-4-5, 9 tasks x 3 seeds, sign test p=0.008 both). Named limit: retrieval RECALLS but does not RANK (mean tie-set 3.3, ties broken by store order, not relevance) — the discrimination gap that motivates the SQLite-FTS5 activation path (ADR-116) at larger scale.
-- kind: quant
-- evidence: internal/bench/reports/second-brain-retrieval.json
-- status: backed
-- last_verified: 2026-07-09
-
 ### claim: lexical-ranking-lift
-- claim: A hand-rolled, dependency-free BM25 + trigram lexical index resolves the "recalls but does not rank" gap: on the retrieval-precision corpus (9 keyword-overlapping-confuser tasks) it drives the mean top tie-set from 3.333 (the `_score` bucket scorer) to 1.0 — every needed decision uniquely top-ranked — with precision@1 and precision@5 unchanged at 1.0. Method: deterministic, model-free re-ranking of the SAME retrieved entry set; both scorers measured over the identical store via `measure_lexical_ranking.ts`.
+- claim: A hand-rolled, dependency-free BM25 + trigram lexical index resolves the "recalls but does not rank" gap: on the retrieval-precision corpus (9 keyword-overlapping-confuser tasks) it drives the mean top tie-set from 3.333 (the `_score` bucket scorer) to 1.0 — every needed decision uniquely top-ranked — with precision@1 and precision@5 unchanged at 1.0. Method: deterministic, model-free re-ranking of the SAME retrieved entry set; both scorers measured over the identical store via `measure_lexical_ranking.ts`. Cross-artefact note (2026-07-25): this baseline (3.333) is the value in THIS claim's own artefact and is cited correctly, but the retrieval-precision artefact records 4.111 for the same scorer on the same corpus — two bench scripts disagree. The lift direction (ties collapse to 1.0) holds under either baseline; the discrepancy itself is unresolved and recorded rather than smoothed.
 - kind: quant
-- evidence: internal/bench/reports/lexical-ranking.json
+- evidence: exec:measure_lexical_ranking -> 0
 - status: backed
 - last_verified: 2026-07-09
 
@@ -140,47 +158,47 @@
 - status: backed
 - last_verified: 2026-07-12
 
----
-
-## Unbacked inventory (documented debt — not yet markered in prose)
+### claim: ledger-exec-verifiability
+- claim: NONE of the backed ledger claims are machine-re-verifiable today — every evidence pointer is checked for existence (file present, substring present, URL carries a date), never for truth, so a claim pointing at a stale artefact stays backed indefinitely. A measured minority COULD carry a re-executing `exec:` form, clearing the >= 10 pp threshold that was pre-registered before the count was taken, which is why that form is scheduled rather than assumed. The rest cannot: paid or stochastic benchmark runs no CI job can re-derive, and prose contracts. Exact counts live in the evidence file and are NOT restated here on purpose — this entry hard-coded its denominator twice and drifted within a day both times (25 when the ledger held 26, then 26 when it held 27) while CI stayed green, because the pointer resolved. `check_claims` now compares the stored denominator against the live ledger and fails on divergence. A number a human retypes on every ledger edit will drift; the fix was to stop retyping it.
+- kind: quant
+- evidence: internal/reports/exec-evidence-feasibility.json#"exec_feasible"
+- status: backed
+- last_verified: 2026-07-25
 
-These are real README claims that need a durable binding before they may carry a
-`<!-- claim: -->` marker. Counts are drift-prone: binding them requires a
-count-source mechanism (a generated number the prose must match). That
-mechanism now exists (road-to-truth-and-reference-hygiene Phase 1):
-`update_counts.ts` generates every prose count from source, and
-`check_artefact_count_messaging.ts` fails CI on any count-shaped prose
-mention that drifts or is internally inconsistent — so the three count
-claims below are `backed`. Remaining entries are listed so the debt is
-visible, not hidden.
+### claim: enforcement-coverage-resolved
+- claim: 14 of 107 governed rules (13.1%) carry a backstop that fails a CI build. The number is RESOLVED, not declared — a `validator:` counts only when the script exists AND a GITHUB WORKFLOW reaches it (transitively, so a sub-check under a wired umbrella counts), and a hook registered `fail_closed: false` resolves to `observer`, never `validator`. The figure was 14 before this correction too, and it was wrong: the resolver treated `taskfiles/` and `.github/workflows/` as one corpus, so "named in a taskfile" counted as blocking — while NO workflow invokes `task ci`, `ci-strict`, or `ci-fast`. Nine of the thirteen validators only ran when a human typed the command. Split into `validator` (CI runs it) and `validator-local` (only a taskfile does), the honest figure was 5 of 107; wiring the nine into `rule-backstops.yml` returned it to 14, this time meaning what the headline says. `local_only` is now 0 and is ratcheted, so a gate cannot drop back out silently. Wiring them also surfaced that FIVE were already failing invisibly — 37 findings, baselined in `rule-backstop-debt.json` and ratcheted against growth. 86 rules declare nothing and count as uncovered, not excluded.
+- kind: quant
+- evidence: exec:check_enforcement_coverage --check -> 0
+- status: backed
+- last_verified: 2026-07-25
 
 ### claim: skill-count
-- claim: 278 skills.
+- claim: 281 skills.
 - kind: quant
-- evidence: src/scripts/check_artefact_count_messaging.ts#Artefact-count messaging gate
+- evidence: exec:check_artefact_count_messaging -> 0
 - status: backed
 - last_verified: 2026-07-08
 
 ### claim: command-count
 - claim: 190 commands.
 - kind: quant
-- evidence: src/scripts/check_artefact_count_messaging.ts#Artefact-count messaging gate
+- evidence: exec:check_artefact_count_messaging -> 0
 - status: backed
 - last_verified: 2026-07-08
 
 ### claim: rule-count
-- claim: 105 governed rules.
+- claim: 107 governed rules.
 - kind: quant
-- evidence: src/scripts/check_artefact_count_messaging.ts#Artefact-count messaging gate
+- evidence: exec:check_artefact_count_messaging -> 0
 - status: backed
 - last_verified: 2026-07-08
 
 ### claim: host-agent-count
-- claim: Compiled into 7+ host agents (Claude Code, Cursor, Augment, Cline, Windsurf, Copilot, Gemini).
+- claim: 23 host agents are detected and inventoried; 20 receive a written config surface (18 projection + 1 plugin + 1 bundle target) and 3 are export-only (aider, zed, jetbrains). The count is enforced, not asserted — `knownToolIds()` is pinned at 23 by a test whose assertion literal IS the number, and `src/config/surface-matrix.yml` is held in set-equality with the installer's own user-scope path map by `lint_surface_matrix`, so a host added to one and not the other fails the build. This entry stood `unbacked` while naming its own unblocking condition ("once `surface-matrix.yml` exists, bind the count to that file and flip"); the condition was met and nothing fired, so the shipped figure stayed "7+" — understating real coverage by 3x.
 - kind: quant
-- evidence: stays unbacked pending a machine-readable projection-targets list — the concrete binding artifact is `src/config/surface-matrix.yml` (authored by road-to-install-path-convergence Phase 2, per the 2026-07-07 install-path council); once it exists, bind the count to that file and flip. Triaged 2026-07-08 (truth-and-reference-hygiene P3): do NOT bind to prose host tables (`docs/enforcement-by-host.md`) — a substring pointer cannot verify a count.
-- status: unbacked
-- last_verified:
+- evidence: exec:vitest run tests/install/toolDetection.test.ts -> 0
+- status: backed
+- last_verified: 2026-07-25
 
 ### claim: orchestration-dispatch-net-win
 - claim: On the ordered-refactor + competitive-impl families (`orch-02`, `orch-03`), contract-governed subagent dispatch nets ≥15% token-or-wall reduction at non-regressed quality vs single-agent execution.
@@ -225,11 +243,11 @@ visible, not hidden.
 - last_verified: 2026-07-12
 
 ### claim: retrieval-substrate-live-pass
-- claim: On the live end-to-end retrieval benchmark (9 tasks × 3 arms × 3 seeds on claude-haiku, fixture store with keyword-overlapping confusers), the memory retrieval substrate scored precision@5 = 100% (9/9) with 100% poisoned-entry rejection, and the retrieval-on arm passed 27/27 model-scored tasks vs 2/27 with retrieval off and 4/27 with a placebo injection. Known limit stays published: mean tie-set 4.1 means top-k ties break by store order, not relevance (the ADR-116/FTS5 signal).
+- claim: On the live end-to-end retrieval benchmark (9 tasks × 3 arms × 3 seeds on claude-haiku, fixture store with keyword-overlapping confusers), the memory retrieval substrate scored precision@5 = 100% (9/9) with 100% poisoned-entry rejection, and the retrieval-on arm passed 27/27 model-scored tasks vs 2/27 with retrieval off and 4/27 with a placebo injection. Known limit stays published: mean tie-set 4.111 means top-k ties break by store order, not relevance (the ADR-116/FTS5 signal). SOLE RECORD for this artefact as of 2026-07-25: a second entry (`second-brain-retrieval-precision`) described the same measurement from the precision angle and had drifted to 5/27, 5/27 and tie-set 3.3 — figures absent from the shared artefact. Two entries over one artefact is what allowed them to disagree while both resolved, so the pair was folded into this one.
 - kind: quant
 - evidence: internal/bench/reports/second-brain-retrieval.json#retrieval-on
 - status: backed
-- last_verified: 2026-07-12
+- last_verified: 2026-07-25
 
 ### claim: wedge-hollow-detection
 - claim: On the A3 orchestration eval (deterministic verify, measured token deltas), the production-validator subagent returned the correct verdict on both fixtures — NOT READY with the exact `file:line` citation on a planted hollow implementation, READY with zero spurious findings on the clean control — while consuming ~45k fewer tokens than the inline-host baseline on each task. Scope: two planted fixtures on a Claude Code host, not a broad hit-rate.
@@ -259,3 +277,10 @@ visible, not hidden.
 - status: unbacked
 - last_verified: 2026-07-21
 - resolution: HONEST-NULL (resolved, not pending). Registered cross-vendor run 2026-07-21 on the curated judge-survivable corpus (internal/bench/adversarial-council/): on the judge-passed residual, the 2-vendor skeptic panel (anthropic+openai) matched the single skeptic exactly (residual recall 0.6 = 0.6, zero lift — the second vendor's residual catches were a strict subset of the first), at a 100% false-positive rate on the controversial-but-correct controls under the adversarial-skeptic posture. Both recall thresholds missed → honest-null → Mode 9 surface stays default-off permanently (like recursive-verification). Reproducible artifact: internal/bench/adversarial-council/runs/. Note: an initial run via `council_cli run` was REJECTED as a measurement artifact (that transport imposes multi-round peer-review + prose output, defeating the independent-skeptic + JSON-scoring protocol) — the valid run uses direct independent per-vendor client calls.
+
+### claim: gated-platform-reads
+- claim: A credential-free prescription layer reads content the host's own web tools cannot fetch at all — Reddit thread text (Atom feeds) AND comment ranking plus reply nesting (server-rendered HTML), and a single named tweet (the platform's own oEmbed endpoint). Measured 2026-07-25 from a residential network against a pre-registered 6-task-per-channel set with a native control and thresholds frozen before the run: reddit tier 1 6/6, reddit tier 2 6/6, twitter-oembed 6/6, native 0/6 on both Reddit tiers. Zero credentials, zero resident processes, zero auto-installs. Scope bounds that travel WITH the claim: (a) the twitter gap is narrower than 6/6 suggests — native also passed 2 of those 6 via third-party mirrors, so the channel earns its place only on tweets nothing mirrors; (b) reddit tier 2 is on an announced closing path and ships with a kill-switch keyed on an OBSERVED login wall; (c) youtube-transcripts is PARKED, not shipped — its backend is human-installed by contract and was never exercised; (d) residential network is load-bearing, and CI is explicitly not a bench environment.
+- kind: quant
+- evidence: docs/benchmark.md#ship-gated-reach
+- status: backed
+- last_verified: 2026-07-25

package/docs/architecture.md

@@ -146,8 +146,8 @@ note, package-internal path-swap, description budget, and the
 
 | Layer | Count | Purpose |
 |---|---|---|
-| **Skills** | 278 | On-demand expertise — stack analysis (Laravel · Symfony · Zend / Laminas · Next.js · React · Node), testing, Docker, API design, security, observability, … |
-| **Rules** | 105 | Always-active constraints — coding standards, scope control, verification, language-and-tone, agent-authority |
+| **Skills** | 281 | On-demand expertise — stack analysis (Laravel · Symfony · Zend / Laminas · Next.js · React · Node), testing, Docker, API design, security, observability, … |
+| **Rules** | 107 | Always-active constraints — coding standards, scope control, verification, language-and-tone, agent-authority |
 | **Commands** | 190 | Slash-command workflows — `/commit`, `/create-pr`, `/fix ci`, `/optimize skills`, `/feature plan`, `/work`, `/implement-ticket`, `/condense`, … |
 | **Guidelines** | 101 | Reference material cited by skills — PHP patterns, Eloquent, Playwright, agent-infra, … |
 | **Templates** | 7 | Scaffolds for features, roadmaps, contexts, skills, overrides |

package/docs/benchmark.md

@@ -646,3 +646,140 @@ defect-finding *quality/lift* claim binds; team mode stays documented as
 judge-survivable-subtlety corpus that breaks the recall ceiling, or (b) a new
 model generation. The worker-via-bundle delegate (roadmap Phase 3 Step 4) stays
 deferred — it re-opened only on a measured review lift, which did not occur.
+
+## Internet-reach prescriptions vs host-native web tools (2026-07-24) — HONEST NULL (capability), cost signal unregistered {#honest-null-reach}
+
+**Question (pre-registered before the run):** does a reach-prescription layer —
+`gh api` for repository metadata, a local feed parser, a keyless discussion-search
+API, `curl` + local HTML→text — beat the host's own web-search / web-fetch tools
+on credential-free dev-research tasks, and at what token cost? The layer was
+prototyped in gitignored scratch first, so both arms were real at scoring time.
+
+**Design.** 12 tasks × 2 arms (`native` = host web tools only; `reach` = the
+prototype prescriptions), 4 parallel subagents, arms judged independently on
+pre-declared acceptance evidence — no arm-vs-arm comparison at scoring time.
+Thresholds, verdict bands and the run protocol were committed **before** the run
+(`internal/bench/reach-vs-native/README.md`); the report is
+`internal/bench/reach-vs-native/VERDICT.md`, raw rows in `results.csv`.
+
+**Result — capability: NULL.** The native arm passed **12/12**. Under the
+pre-registered rule (reach wins only where native fails; **ties are native
+wins**) the reach arm scored **0 outright wins of 12** → band **`stop`**. Two
+reach failures were prescription defects (a 400-char excerpt cap; a `jq`
+projection dropping the release body), and repairing them **cannot** move the
+band: the native arm passed those tasks too, so a repaired reach arm scores a
+tie. Zero native failures ⇒ zero possible reach wins.
+
+**Consequence: no router skill shipped.** The `internet-reach` router was
+cancelled pre-authoring by its own Phase-0 gate. What did ship is the
+verdict-independent operator tooling — a schema-validated channel registry, a
+five-state probe engine with stale-shim detection, a read-only `reach:doctor`,
+and a CI gate that fails on any unpinned install prescription.
+
+**Honest bound.** The credential-free constraint (needed for reproducibility)
+structurally excluded the two cases where a reach advantage was hypothesized:
+video subtitles (backend absent → `untested`) and authenticated / rate-limited
+platform access (impossible in a keyless set). The null therefore reads narrowly:
+*on public, credential-free dev-research tasks, a reach prescription layer buys
+no capability the host does not already have.* It says nothing about gated-platform
+access. Testing that needs a credentialed task set with its own pre-registration.
+
+**Unregistered observation — cost, not capability.** On all 8 tasks both arms
+solved, the reach arm was cheaper: **3,070 vs 6,730 tokens (0.46×)**, largest
+gaps on repository metadata (0.26×) and discussion search (0.31×). The native
+arm's overhead was *discovery*: it repeatedly had to find the machine-readable
+endpoint the prescription already knows. This is recorded **outside** the
+decision — S0b was authored as a ≤1.5× guardrail, never a win condition, and
+promoting it to one after seeing the data would be the post-hoc rigging the bands
+exist to prevent. Acting on it requires a separate, cost-primary pre-registration
+(equal-evidence tasks, token cost as the primary metric, a stated minimum saving
+worth the maintenance burden).
+
+## Gated-platform reads (2026-07-25) — SHIP (3 channels), with a narrowed gap on one {#ship-gated-reach}
+
+**Question (pre-registered before the run):** on platforms the host's own web tools
+cannot reach at all, are credential-free prescriptions **reliable** enough to justify
+their maintenance weight — measured **per channel**, never aggregated?
+
+This is deliberately not the question the parent bench asked. The
+[internet-reach null](#honest-null-reach) measured whether a prescription layer beats
+native tools on credential-free dev research, answered **no** (0/12, band `stop`), and
+named its own bound: *"It says nothing about gated-platform access. Testing that needs
+a credentialed task set with its own pre-registration."* This run is that test —
+except it turned out **no credentials are needed**, which is itself the finding that
+made it worth running.
+
+**The capability gap is established, not assumed.** Measured the same session, first
+hand: `reddit.com` is refused at the domain level by the host's own tool (a
+client-side refusal, not a 403 from Reddit); `x.com/<user>/status/<id>` answers **HTTP
+402**; a YouTube watch page answers 200 with metadata and no transcript.
+
+**Design.** 6 tasks per channel with pre-declared acceptance evidence, each with a
+**native-arm control**, thresholds frozen before the run (≥5/6 ship · 3–4/6 park ·
+≤2/6 drop), one documented repair per task allowed, verdicts never aggregated.
+Pre-registration: `internal/bench/gated-reach/README.md`; rows and evidence:
+`internal/bench/gated-reach/results.md`.
+
+| Channel | reach | native | Verdict |
+|---|---|---|---|
+| `reddit` tier 1 — Atom text | **6/6** | 0/6 | **ship** |
+| `reddit` tier 2 — ranking + thread structure | **6/6** | 0/6 | **ship** — time-bounded |
+| `twitter-oembed` — single tweet | **6/6** | 2/6 | **ship** — narrowed gap, below |
+| `youtube-transcripts` | not run | — | **park** — unexercised (backend absent by design) |
+
+**Reddit is a real, unambiguous capability.** Post text, comment text with authors
+(147 feed entries on the test thread, 135 author-bearing), and — via server-rendered
+HTML — **comment scores and reply nesting** (134 comments across 7 depth levels,
+scores cross-checked against the rendered page). Native scores 0/6 by construction:
+there is no native path to a domain the host refuses. The rate limiting that makes
+this fragile is solved with **no new code** — `curl --retry 8 --retry-max-time 110`
+measured 5/5 against 2/6 without it, because curl treats 429 as retryable and backs
+off exponentially when `--retry-delay` is omitted.
+
+**Tier 2 ships with an expiry, not a promise.** Reddit announced a login requirement
+for the server-rendered interface on 2026-06-30 and withdrew its earlier commitment to
+keep it available. Logged-out access still worked on 2026-07-25. It therefore ships
+with a kill-switch keyed on an **observed** login wall — never on the announcement —
+and with tier 1 as the permanent fallback. Degradation is a documented output
+(`login_wall: true`, "ranking unavailable"), because presenting unranked text as
+ranked is the one failure mode here that produces wrong conclusions rather than a
+missing answer.
+
+**The control rule fired, and the Twitter story is narrower than its 6/6.** The first
+task set used the most-quoted tweets in existence; native scored **5/6** on them — not
+by reading `x.com`, but because a canonical tweet's text is reproduced everywhere.
+Those five tasks were **removed and replaced** per the pre-registered control rule.
+On five genuinely obscure tweets native dropped to **2/6**, and one of its two
+"passes" came from the author's Threads and Mastodon cross-posts rather than Twitter.
+Where it failed it failed usefully badly: on one tweet it produced a paraphrase and a
+**confidently wrong month**, and it cannot distinguish a deleted tweet from a live one
+(both answer 402). So the honest reading of Twitter's 6/6 is: *the channel is reliable,
+and the gap it closes is narrow* — for any tweet discussed anywhere, native search
+already recovers the content; the channel earns its place on the case where a specific
+URL is in hand and nothing mirrors it.
+
+**A bench limitation, published rather than engineered away.** The control rule says a
+native pass means the task was mis-scoped, so the two native-passed Twitter tasks
+should have been replaced again. They were not, and the reason is structural: every
+tweet-sourcing channel available to a host that cannot read Twitter — HN links, Reddit
+links, search — selects for tweets that *were* discussed publicly, which is exactly the
+population native search recovers. Sourcing an undiscussed tweet requires the access
+this bench exists because we lack. The 6/6 stands on the frozen threshold; the caveat
+is recorded here so nobody later reads it as "six things only this channel can do".
+
+**YouTube is parked, not scored.** `yt-dlp` is absent and the package never
+auto-installs. Per the pre-registered unexercised rule, a channel that cannot be
+exercised cannot reach ship and is not counted as a drop — an uninstalled tool is a
+fact about this machine, not about the channel. What did ship for it is the readiness
+check that closes the blind spot the parent bench left open: a passing `yt-dlp
+--version` does **not** imply extraction works, because full YouTube support needs an
+external JS runtime, so the doctor inspects the yt-dlp config semantically and reports
+a distinct `not-ready` state with an idempotent fix command.
+
+**Three prescription defects were found by executing the prescriptions verbatim** —
+none would have been caught by review: a single HTML-entity decode pass leaves
+`&mdash;` in tweet text; a missing `-f` makes a deleted tweet answer **exit 0 with
+3,663 bytes of error HTML** that a caller reads as success; and a dropped `-L` makes
+the oEmbed endpoint answer 301 with an empty body, which looks like a dead service.
+All three are fixed and documented as load-bearing in
+[`docs/guides/gated-platform-reads.md`](guides/gated-platform-reads.md).

package/docs/catalog.md

@@ -1,13 +1,13 @@
 # agent-config — Public Catalog
 
-Consumer-facing catalog of all **673 public artefacts** shipped by
+Consumer-facing catalog of all **678 public artefacts** shipped by
 this package. Internal package-maintenance rules and deprecation shims
 are excluded.
 
 > **Regenerate:** `./scripts-run src/scripts/generate_index`
 > Auto-generated — do not edit manually.
 
-## Skills (278)
+## Skills (281)
 
 > **Behavioural-eval coverage is measured, not implied.** A skill is
 > behaviourally evaluated only if it ships `evals/evals.json`; most do
@@ -61,6 +61,7 @@ are excluded.
 | skill | [`character-consistency`](../dist/agent-src/skills/character-consistency/SKILL.md) | official | Use when a character must stay visually identical across AI video scenes — locks identity tokens (silhouette, palette, wardrobe, prop) in JSON. Triggers 'character lock', 'same character'. |
 | skill | [`check-refs`](../dist/agent-src/skills/check-refs/SKILL.md) | official | Use when verifying cross-references between skills, rules, commands, guidelines, and context documents are not broken after edits, renames, or deletions. |
 | skill | [`churn-prevention`](../dist/agent-src/skills/churn-prevention/SKILL.md) | official | Use when designing churn defence — health-score signals, churn-cause split (involuntary / value / relationship / fit), early-warning loop. Triggers on 'why are accounts leaving'. |
+| skill | [`code-intelligence`](../dist/agent-src/skills/code-intelligence/SKILL.md) | official | Route codebase-structure questions (who calls X, where used, what imports, change-impact) to a code-graph first, grep fallback. Triggers 'who calls', 'where is this used', 'call graph'. |
 | skill | [`code-refactoring`](../dist/agent-src/skills/code-refactoring/SKILL.md) | official | Use when the user says 'refactor this', 'rename class', or 'move method'. Safely refactors code in any language — finds all callers, updates downstream dependencies, verifies via quality tools. |
 | skill | [`code-review`](../dist/agent-src/skills/code-review/SKILL.md) | official | Use when the user says \"review this\", \"check my code\", or wants feedback on changes. Reviews for correctness, quality, security, and coding standards. |
 | skill | [`command-routing`](../dist/agent-src/skills/command-routing/SKILL.md) | official | Use when the user invokes a slash command like /create-pr, /commit, /fix-ci, or pastes command file content — routes to the right command with context inference and GitHub API patterns. |
@@ -124,6 +125,7 @@ are excluded.
 | skill | [`frontend-render-security`](../dist/agent-src/skills/frontend-render-security/SKILL.md) | official | Writing/reviewing client-side UI (React/Vue/vanilla) — insecure-render + client-trust gaps AI ships: XSS via innerHTML, client secrets, client-only auth, CORS wildcard, token in localStorage |
 | skill | [`fundraising-narrative`](../dist/agent-src/skills/fundraising-narrative/SKILL.md) | official | Use when shaping a capital-raise pitch — why-now / why-us / why-this framing, market-size reasoning, traction-story construction. Triggers on 'tighten the pitch', 'why-now is weak'. |
 | skill | [`funnel-analysis`](../dist/agent-src/skills/funnel-analysis/SKILL.md) | official | Use when diagnosing where a SaaS or product funnel leaks — visitor → signup → activation → paid → retained — channel-agnostic, conversion-rate-driven. |
+| skill | [`gated-reach`](../dist/agent-src/skills/gated-reach/SKILL.md) | official | Read a Reddit thread or single tweet the host cannot fetch — 'what does this Reddit thread say', 'top comment on this post', 'what does this tweet say' — when reddit.com is refused or x.com 402s. |
 | skill | [`git-workflow`](../dist/agent-src/skills/git-workflow/SKILL.md) | official | Use when working with Git — branch naming, commit messages, PR creation, rebasing, or the code review process — even when the user says 'push this' or 'merge the branch' without naming Git. |
 | skill | [`github-ci`](../dist/agent-src/skills/github-ci/SKILL.md) | official | Use when working with GitHub Actions — workflow YAML, quality gates, test matrices, deployment triggers, reusable workflows — even when the user just says 'my CI is failing' or 'add a check'. |
 | skill | [`grafana`](../dist/agent-src/skills/grafana/SKILL.md) | official | Use when working with Grafana — dashboards, Loki LogQL queries, alerting rules, monitoring panels — even when the user just says 'build me a dashboard' or 'query the logs' without naming Grafana. |
@@ -256,6 +258,7 @@ are excluded.
 | skill | [`runway-cognition`](../dist/agent-src/skills/runway-cognition/SKILL.md) | official | Use when reasoning about cash runway — burn shape, fundraise triggers, layoff-vs-cut-vs-grow decisions. Triggers on 'how long do we have', 'should we raise', 'cut or grow'. |
 | skill | [`scenario-modeling`](../dist/agent-src/skills/scenario-modeling/SKILL.md) | official | Use when constructing base / upside / downside scenarios — three-statement modeling, sensitivity analysis, optionality reasoning. Triggers on 'model the scenarios', 'what if growth halves'. |
 | skill | [`scene-expander`](../dist/agent-src/skills/scene-expander/SKILL.md) | official | Use when expanding a one-line idea into the 12-block Cinematic Scene Blueprint — provider-agnostic, includes optional dialogue + ambient. Triggers 'expand this scene', 'blueprint for X'. |
+| skill | [`screenshot-hygiene`](../dist/agent-src/skills/screenshot-hygiene/SKILL.md) | official | Use when creating and embedding a documentation screenshot — detect and redact sensitive data, human-gate data-bearing shots before ship. Triggers 'screenshot for docs', 'screenshot admin panel'. |
 | skill | [`script-writing`](../dist/agent-src/skills/script-writing/SKILL.md) | official | Use when adding or editing any script under `scripts/` — `--quiet`, `_lib/script_output`, silent Taskfile wiring, Iron-Law carve-outs; fires on 'add a check script for X'. |
 | skill | [`secrets-management`](../dist/agent-src/skills/secrets-management/SKILL.md) | official | Use when picking a secrets store, designing rotation, or wiring scanning gates — multi-cloud (Vault, AWS, Azure, GCP), CI, and Kubernetes — decision framework, provider deep-dives externalized. |
 | skill | [`security`](../dist/agent-src/skills/security/SKILL.md) | official | Use when applying security best practices — authentication, authorization, CSRF protection, input sanitization, rate limiting, or secure coding — stack-agnostic. |
@@ -306,7 +309,7 @@ are excluded.
 | skill | [`wireframe`](../dist/agent-src/skills/wireframe/SKILL.md) | official | Explore a flow or layout with 3+ disposable lo-fi greyscale wireframes on a named axis, before any hi-fi work. Use when the user wants to sketch directions or explore structure. |
 | skill | [`worktree-lifecycle`](../dist/agent-src/skills/worktree-lifecycle/SKILL.md) | official | Use when governing a worktree across its whole life — scope-lock declaration, merge-readiness status, scoped verification, and safe cleanup that refuses while unique unmerged commits exist. |
 
-## Rules (104)
+## Rules (106)
 
 | kind | name | type | description |
 |---|---|---|---|
@@ -337,6 +340,7 @@ are excluded.
 | rule | [`design-fidelity`](../dist/agent-src/rules/design-fidelity.md) | auto | A provided prototype/mockup/design system is the spec — build 1:1; never swap fonts, controls, or layout unconfirmed |
 | rule | [`devcontainer-routing`](../dist/agent-src/rules/devcontainer-routing.md) | auto | Wiring DevContainers/Codespaces (devcontainer.json, features, ports) — route to the devcontainer skill |
 | rule | [`direct-answers`](../dist/agent-src/rules/direct-answers.md) | always | Always — direct, unembellished answers. No flattery, no invented facts (verify load-bearing claims, otherwise ask). Emojis only as functional markers. Brevity is the default. |
+| rule | [`doc-screenshot-hygiene`](../dist/agent-src/rules/doc-screenshot-hygiene.md) | auto | Screenshots for docs — anonymize sensitive data before shipping; data-bearing shots are human-gated (published egress); terminal/CLI/IDE screenshots forbidden |
 | rule | [`docker-commands`](../dist/agent-src/rules/docker-commands.md) | auto | Running PHP inside Docker — artisan, composer, phpstan, rector, ecs, phpunit, tests, migrations, any CLI tool |
 | rule | [`domain-adoption-policy`](../dist/agent-src/rules/domain-adoption-policy.md) | auto | Adopting a new domain track (mobile, ML, IoT…) — demand/owner/CI gates BEFORE harvest |
 | rule | [`domain-safety-disclaimer`](../dist/agent-src/rules/domain-safety-disclaimer.md) | auto | Advisory content (legal, medical, financial, consulting) — matching 'not X advice' disclaimer; refuse diagnosis/dosage |
@@ -391,6 +395,7 @@ are excluded.
 | rule | [`rule-type-governance`](../dist/agent-src/rules/rule-type-governance.md) | auto | Creating/editing rules, or auditing rule types — decides when a rule should be always vs auto |
 | rule | [`runtime-safety`](../dist/agent-src/rules/runtime-safety.md) | auto | Skill declares execution metadata — enforce safety constraints for assisted/automated execution types |
 | rule | [`scope-control`](../dist/agent-src/rules/scope-control.md) | always | Scope control — no unsolicited architectural changes, refactors, or library replacements |
+| rule | [`secret-vcs-guard`](../dist/agent-src/rules/secret-vcs-guard.md) | auto | About to write a credential into a tracked file or stage/commit one in any VCS (git/svn/hg) — STOP, show the match, ask, offer alternatives; never silently commit, never silently strip |
 | rule | [`security-sensitive-stop`](../dist/agent-src/rules/security-sensitive-stop.md) | auto | Security-sensitive paths (auth, billing, tenants, secrets, uploads, webhooks) — threat-model BEFORE editing |
 | rule | [`senior-engineering-discipline`](../dist/agent-src/rules/senior-engineering-discipline.md) | auto | Writing/generating code — generalize (no overfit or tautological tests), supply the invisible cross-cutting controls the prompt didn't name, never invent an API/field/package |
 | rule | [`size-enforcement`](../dist/agent-src/rules/size-enforcement.md) | manual | Creating or editing rules, skills, commands, guidelines, AGENTS.md, or copilot-instructions.md — enforce size and scope limits |

package/docs/comparison.yaml

@@ -12,34 +12,76 @@
 # check_claims pointer resolver); every `checkable: true` row's `our_evidence`
 # resolves. build_proof renders these rows. check_no_external_sources guarantees
 # no named source leaks in.
+#
+# `failure_mode` (optional) — what this row's claim prevents, in adopter-facing
+# voice. A populated row ALSO renders in the "What each one prevents" view on the
+# proof page; an empty field is the honest signal that the row is comparative
+# only. Membership in that view is therefore a data property, never a curated
+# short-list that can drift from this table.
+#
+# THE PIN SHAPE IS REFUSED HERE, DELIBERATELY. A number in these rows is bound by
+# a resolving pointer — never by a test asserting that a literal string appears in
+# a doc. A comparable suite pinned a marketing figure with an
+# `assertIn("<number> tokens", …)` test; its own published formula yields a value
+# ~4x larger, and the pin turned the wrong number into a protected invariant that
+# CI actively defended. A pointer can go stale and be re-derived; a pin makes
+# staleness the passing condition.
 
 rows:
-  - claim: "No runtime — no background daemon, no state database, no auto-write memory."
+  - claim: "No resident runtime — no background daemon, no state database or service, no auto-write memory; deterministic, rebuildable file indexes only."
     our_evidence: "docs/contracts/no-runtime-boundary.md#file-first"
-    their_evidence: "Swarm-runtime tools in this category ship a background process and/or a state store by design; that is an architectural fact of the runtime approach, not a defect."
+    their_evidence: "Swarm-runtime tools in this category ship a background process and/or a resident state store by design; that is an architectural fact of the runtime approach, not a defect."
     checkable: true
+    failure_mode: >-
+      A background process keeps running after you stop using it, holds state you did not write, and has to be kept alive and upgraded.
 
   - claim: "Capability/benchmark results are published — including the runs where the package changed nothing."
     our_evidence: "docs/benchmark.md"
     their_evidence: "A category headline figure (e.g. an '84.8%' score) appears across marketing surfaces with no reproducible methodology published — so it cannot be verified either way."
     checkable: true
+    failure_mode: >-
+      You adopt on a headline number nobody can re-run, and never learn which of its measurements changed nothing.
 
   - claim: "Every public claim binds to machine-checked evidence."
     our_evidence: "docs/CLAIMS.md"
     their_evidence: "Marketing claims in this category are not bound to a machine-checked ledger a reader can reproduce."
     checkable: true
+    failure_mode: >-
+      A shipped number drifts from the artefact it came from and stays published, because nothing re-checks the claim against its source.
 
   - claim: "Skills publish their own known limits, each with a witness test."
     our_evidence: "tests/scripts/witness/check_refs_relative_gap.test.ts"
     their_evidence: "Published known-limitation surfaces backed by reproducing tests are not a standard artifact in this category."
     checkable: true
+    failure_mode: >-
+      A limitation is discovered by you, in your repo, at the moment it costs you something — instead of being stated up front and held by a test.
 
   - claim: "A 30-second single-file wedge exists — one read-only subagent, one command, verdict with file:line — and its promise is a scoped, published eval, not a feature list."
     our_evidence: "internal/bench/orchestration/pv-a3-results.md#token_delta_provenance: measured"
     their_evidence: "Category entry points typically install the full platform (profiles, packs, runtime) before the first felt win; single-artifact entries with a published eval behind the promise are not a standard artifact."
     checkable: true
+    failure_mode: >-
+      Evaluating the tool means installing the whole platform first, so the first thing you learn is the setup cost rather than whether it works.
 
   - claim: "The persona-identity question was tested and published as an honest null (identity swap ~zero effect, provider choice ~15x larger) instead of being shipped as theater."
     our_evidence: "internal/bench/reports/persona-placebo.json#honest-null"
     their_evidence: "Named-persona prompts are shipped as a feature across the category without a published A/B separating identity from method."
     checkable: true
+    failure_mode: >-
+      You pay tokens for prompt theater that was never measured against the method text it wraps.
+
+  - claim: "Every upstream-tool install prescription the package ships is version-pinned, intake-recorded, and enforced offline in CI — an unpinned version, a branch/archive install source, or a pipe-remote-to-shell instruction fails the build."
+    our_evidence: "src/scripts/validate_reach_prescriptions.ts"
+    their_evidence: "Capability layers in this category commonly install themselves and their upstream dependencies from a moving target (a branch archive or an unpinned package) via a piped remote installer; whether any given one pins is observable per repo, but a CI gate that fails the build on an unpinned prescription is not a standard artifact."
+    checkable: true
+    failure_mode: >-
+      An install instruction silently follows a moving target — an unpinned package or a piped remote script — so what lands in your repo is whatever the source held that day.
+
+  - claim: "Platform reads that the host's own web tools cannot perform at all (a refused domain, an HTTP 402) are shipped as credential-free prescriptions whose reliability was measured per channel against a native control, with the thresholds frozen before the run and the narrowing caveat published alongside the pass."
+    our_evidence: "docs/benchmark.md#ship-gated-reach"
+    their_evidence: "Reaching gated platforms is commonly solved in this category by asking for an API key or a session cookie, and the capability is asserted from a feature list rather than a per-channel reliability measurement with a native-arm control; publishing the case where the native tools already suffice, next to the pass, is not a standard artifact."
+    checkable: true
+    failure_mode: >-
+      You hand over a credential — or your account — for a read the tools could
+      already do, and you cannot tell which channels actually work because the
+      capability was claimed rather than measured.

package/docs/contracts/local-server-ports.md

@@ -0,0 +1,53 @@
+# Contract: local server ports + host integration
+
+> The loopback/port contract `src/server/port.ts` enforces, plus the
+> host-integration surface (config root + embed) a host like agent-switch binds
+> to. This file resolves the long-standing pointer in `src/server/port.ts`.
+
+## Port range
+
+- The GUI/API server binds on **loopback `127.0.0.1` only**, on a free port in
+  **41000–41999** (per ADR-012). `src/server/port.ts` picks a free port by
+  actually binding (no is-free → bind race) and refuses any range that overlaps
+  the privileged ports `[0, 1024]` or strays outside this documented range —
+  both are anti-regression guards (`validateRange`).
+- The chosen port is ephemeral per process; a host discovers the live port from
+  the server-info readout, never by assuming a fixed value.
+
+## Auth token
+
+- `src/server/token.ts`: a 32-byte hex token, per-process, mode `0600`, replaced
+  on every boot. The SPA reads it once from `?token=` at boot, then strips it
+  from the URL; subsequent calls use the `Authorization: Bearer` header. There is
+  no cookie. A host must re-read the token after every respawn.
+
+## Host integration — config root
+
+- `agent-config --config-root <path>` (flag) or `EVENT4U_CONFIG_HOME` (env) sets
+  AC's config home. Precedence: **flag > env > default**; absent → default
+  behavior is unchanged. This lets a host give AC a per-profile config root so
+  profile-scoped settings do not silently collide.
+
+## Host integration — embed
+
+- `?embed=1` renders AC chrome-stripped (no standalone nav/brand, no theme
+  toggle — the host owns the theme); settings deep-links `#/settings` and
+  `#/settings/<section>` keep working.
+- **Framing:** AC sends CSP `frame-ancestors 'none'` and is **never** iframe-able
+  — a host renders AC's URL in a **separate top-level window**, not a frame.
+- `?theme=light|dark` feeds the pre-paint `data-theme` stamp (no flash).
+
+## Capability discovery
+
+- `GET /api/v1/ping` and `agent-config --version --json` carry a `capabilities`
+  block: `{ configRoot: true, embed: { supported: true, version: 1, features:
+  ['theme', 'deepLink'] } }`. A host checks a capability, not a version number —
+  an older AC omits the block and the host degrades to a clear "not supported".
+
+## References
+
+- Port range: ADR-012. Enforcement: `src/server/port.ts`.
+- Token transport: `src/server/token.ts`.
+- Capabilities source: `src/shared/capabilities.ts`.
+- Host-side plans: `agents/roadmaps/road-to-ac-embeddable-gui.md`,
+  `agents/roadmaps/road-to-reciprocal-ecosystem.md`.

package/docs/contracts/no-runtime-boundary.md

@@ -37,7 +37,7 @@ and violating the no-runtime principle).
 | Category | Why |
 |---|---|
 | **Background processes / daemons** | No spawned subprocesses that outlive the current agent turn |
-| **Cross-session persistent state stores** | No SQLite, pgvector, MCP memory servers, Redis, or any store that persists beyond the git working tree — agent-memory layer sunset applies here |
+| **Cross-session persistent state stores** | No SQLite, pgvector, MCP memory servers, Redis, or any store that persists beyond the git working tree — agent-memory layer sunset applies here. **Carve-out (ADR-124 § 6): a gitignored, deterministic, rebuildable build/index artifact under `agents/runtime/state/` is a build output, not a state store** — it carries no authority, is reproducible from the working tree, and is never auto-written memory. State-store test: if deleting the artifact changes *what* the tool can answer rather than only *how fast* it answers, it is a state store and prohibited (a code-graph cache passes — deletion only slows recompute; a vector/embedding index fails — it enables query semantics absent from source, and stays Class C). |
 | **Event loops / polling** | No `while true; do …; done`, no `inotifywait`, no cron-inside-mission |
 | **Auto-PR / auto-push** | Hard-Floor (`non-destructive-by-default`): missions never push to remote or open PRs autonomously; those gates require explicit user confirmation every turn |
 | **Network egress from mission scripts** | Mission scripts may not initiate outbound HTTP calls; skills that need network access declare `allowed_tools` explicitly and go through the normal lethal-trifecta gate |