@event4u/agent-config 9.7.0 → 9.8.0

package/docs/proof.md

@@ -9,6 +9,25 @@ public claim binds to resolvable evidence; a skeptic can reproduce
 every check below on a fresh checkout. This page is itself generated
 from those sources and fails CI if it drifts.
 
+## What this prevents
+
+Each row is a failure mode, not a feature — and each cites the ledger
+claim that backs it. A row whose claim stopped resolving would fail this
+page's own generator, so the table cannot outlive its evidence.
+
+| Failure this prevents | How | Backed by |
+|---|---|---|
+| A rule says MUST, and nothing anywhere enforces it — so the rule reads as a guarantee while being honour-system. | Each rule declares `enforced_by:`, and the check **resolves** it: a validator reachable from no taskfile, workflow, or hook manifest counts as unwired, not as covered. Undeclared counts as uncovered. | [`enforcement-coverage-resolved`](CLAIMS.md) ⟳ |
+| A shipped artefact carries a hidden-Unicode or instruction-smuggling payload, and reaches consumers because only the source tree was scanned. | Source **and** the condensed projection are scanned in CI; a finding blocks the release before publish, not merely the merge. | [`shipped-artifacts-hidden-instruction-scanned`](CLAIMS.md) ⟳ |
+| A count in public prose drifts from the source, and the marketing number quietly stops being true. | Counts are generated from source and drift-checked; the build fails on a count-shaped prose mention that disagrees, or on two different numbers for the same artefact kind. | [`skill-count`](CLAIMS.md) ⟳ |
+| A host-coverage claim understates or overstates what actually works — for months, on the one surface everybody reads. | The number is pinned by a test over real detection, and the test is re-run as the claim evidence. | [`host-agent-count`](CLAIMS.md) ⟳ |
+| A non-coding domain skill implies proven correctness it never had, because it was forged on a different domain and never checked against one. | Domain skills are labelled unvalidated until they pass a sourced domain-truth fixture, and the validated count is ratcheted so it cannot quietly fall. | [`domain-soundness-scoped`](CLAIMS.md) ⟳ |
+| Behavioural-eval coverage regresses as skills are added, and the suite looks healthy because only the absolute number is reported. | Coverage is measured per tier and ratcheted in CI, so it can only rise; the gap is published rather than implied away. | [`eval-coverage-ratcheted`](CLAIMS.md) ⟳ |
+
+⟳ — the claim carries `exec:` evidence: CI re-runs the command and
+compares its exit code, so a stale row turns the build red rather than
+ageing quietly into marketing.
+
 ## See it run (< 60s, real output)
 
 ![The trust surface running green — every "verify it yourself" command below, recorded from a real run](media/proof-demo.gif)
@@ -27,31 +46,68 @@ evidence pointer, or `task check-claims` fails the build.
 | Claim | Kind | Evidence | Resolves |
 |---|---|---|---|
 | The release process is documented as an inheritable runbook + succession doc, and the project's bus-factor (trailing-90-day distinct human reviewers) is tracked and reported truthfully — currently 1, not implied to be more. | qual | `docs/succession.md#trailing 90 days` | ✅ |
-| 190 commands. | quant | `src/scripts/check_artefact_count_messaging.ts#Artefact-count messaging gate` | ✅ |
+| 190 commands. | quant | `exec:check_artefact_count_messaging -> 0` | ✅ |
 | A MEASURED-BUT-NOT-SHIPPED experiment — the thin rule projection reduced eager rule load 78,513 → 13,881 GPT-tokens (whole always-loaded projection 98,529 → 33,897, ~65.6%), but FAILED the quality gate (thin win-rate 36.2% vs required 48%) and does not ship; it un-defers only behind `discipline_profile: essential`. Shipped behavior does NOT include this reduction. Method: `agent-config benchmark` over the pinned token baseline; the baseline is the honest "what the user pays if everything loads eagerly", NOT a synthetic full-corpus strawman (council Q4); quality gate per the Phase-0 paired judge run. | quant | `internal/bench/reports/token-baseline.json#eager_rule_load` | ✅ |
 | The first cross-vendor parity pass (5 orchestration-corpus tasks × 2 vendors × 3 repeats, identical prompts via the council transport, $0.16) measured real per-host finding-count differences — claude-sonnet-4-5 surfaced ~2× the findings of gpt-4o on the multi-file analysis task (median 11 vs 5) while both vendors were identical on the planted hollow-implementation task (2 vs 2) and perfectly silent on the clean-code negative control (0 vs 0, no spurious findings). The per-task `finding_floor` values are calibrated from the cross-host lower envelope and the gate is armed. | quant | `internal/bench/reports/parity-count.json#min over hosts of median` | ✅ |
 | On a weak host (claude-haiku-4-5) the package produces a significant, placebo-controlled discipline lift on scope/downstream traps; on a strong host the same measurement is a published null — the package transplants discipline a weak model lacks, not model intelligence. | quant | `docs/benchmark.md#weak-host-specific` | ✅ |
-| The non-coding domain skills (finance/founder/ops/content) are forged on TS/PHP and labeled unvalidated until they pass a sourced domain-truth fixture; no public prose implies proven domain correctness, and the validated count is CI-ratcheted. | qual | `src/scripts/domain_soundness_status.ts#checkRatchet` | ✅ |
-| The validated non-coding domain-skill count is pinned and CI-ratcheted at a maintainer-set floor (9 of 20 default-surface skills carry a sourced `evals/domain-truth.json` fixture at pin time, 2026-07-11 — 5 deterministic, keys from cited formulas; 4 rubric, criteria matching a named external practice); the floor only rises via a maintainer `--write-floor` after a new sourced fixture lands. | quant | `internal/evals/domain-soundness-floor.json#validated` | ✅ |
+| The non-coding domain skills (finance/founder/ops/content) are forged on TS/PHP and labeled unvalidated until they pass a sourced domain-truth fixture; no public prose implies proven domain correctness, and the validated count is CI-ratcheted. | qual | `exec:domain_soundness_status --check -> 0` | ✅ |
+| The validated non-coding domain-skill count is pinned and CI-ratcheted at a maintainer-set floor (9 of 20 default-surface skills carry a sourced `evals/domain-truth.json` fixture at pin time, 2026-07-11 — 5 deterministic, keys from cited formulas; 4 rubric, criteria matching a named external practice); the floor only rises via a maintainer `--write-floor` after a new sourced fixture lands. | quant | `exec:domain_soundness_status -> 0` | ✅ |
 | On the READ-ONLY FAN-OUT slice family, tier-downshifted subagent dispatch (lite/haiku vs session-tier-proxy sonnet) nets a ≥30% USD-weighted token-cost reduction at held quality — measured 2026-07-08 (n=10 paired live dispatches, 20 telemetry lines): 10/10 exact-match on BOTH arms, 29.4% fewer raw tokens, 76.5% USD-weighted cost reduction at the 3x haiku↔sonnet price ratio. FAMILY-SCOPED — the mechanical-edit family is unmeasured and its downshift (incl. the deferred tier downgrades of existing units) stays gated. Negative control held: an open-ended synthesis/unknown slice never resolves below the session tier (inferSliceTier → medium/inherit, never lite). | quant | `internal/bench/routing-downshift/results-2026-07-08.md#FAMILY-SCOPED PROVE` | ✅ |
+| 14 of 107 governed rules (13.1%) carry a backstop that fails a CI build. The number is RESOLVED, not declared — a `validator:` counts only when the script exists AND a GITHUB WORKFLOW reaches it (transitively, so a sub-check under a wired umbrella counts), and a hook registered `fail_closed: false` resolves to `observer`, never `validator`. The figure was 14 before this correction too, and it was wrong: the resolver treated `taskfiles/` and `.github/workflows/` as one corpus, so "named in a taskfile" counted as blocking — while NO workflow invokes `task ci`, `ci-strict`, or `ci-fast`. Nine of the thirteen validators only ran when a human typed the command. Split into `validator` (CI runs it) and `validator-local` (only a taskfile does), the honest figure was 5 of 107; wiring the nine into `rule-backstops.yml` returned it to 14, this time meaning what the headline says. `local_only` is now 0 and is ratcheted, so a gate cannot drop back out silently. Wiring them also surfaced that FIVE were already failing invisibly — 37 findings, baselined in `rule-backstop-debt.json` and ratcheted against growth. 86 rules declare nothing and count as uncovered, not excluded. | quant | `exec:check_enforcement_coverage --check -> 0` | ✅ |
 | The lift-carrying essential cut (kernel + downstream-changes) keeps a significant weak-host discipline lift at a fraction of the full load's tokens, and the lift is FAMILY- and HOST-SCOPED — measured on three hosts: claude-haiku-4-5 (weak) shows the family-scoped lift (trapE 0.533→1.000, 7/7 discordant, corpus cost 1.71x); claude-sonnet-4-6 (strong) is a ceiling null; gpt-5-mini (non-Claude weak, codex prompt-prepend surface) FAILED replication with headroom (corpus Δ=+0.024 p=0.70, capability trend n.s. — no harm claimed, injection-surface confound documented). Therefore discipline_profile: auto enables the lift only where measured (vendor-granular unknown_defaults). Non-claims — the balanced router profile was removed after a NULL measurement (p=0.81, n=24); no full-tier recommendation exists; no cross-vendor lift is claimed. | quant | `docs/benchmark.md#REPLICATION FAILED` | ✅ |
-| Behavioural-eval coverage is measured per tier and CI-ratcheted so it can only rise; the current coverage and its gap are published, never implied as "264 evaluated skills". | qual | `src/scripts/skill_eval_coverage.ts#checkRatchet` | ✅ |
+| Behavioural-eval coverage is measured per tier and CI-ratcheted so it can only rise; the current coverage and its gap are published, never implied as "264 evaluated skills". | qual | `exec:skill_eval_coverage --check -> 0` | ✅ |
+| A credential-free prescription layer reads content the host's own web tools cannot fetch at all — Reddit thread text (Atom feeds) AND comment ranking plus reply nesting (server-rendered HTML), and a single named tweet (the platform's own oEmbed endpoint). Measured 2026-07-25 from a residential network against a pre-registered 6-task-per-channel set with a native control and thresholds frozen before the run: reddit tier 1 6/6, reddit tier 2 6/6, twitter-oembed 6/6, native 0/6 on both Reddit tiers. Zero credentials, zero resident processes, zero auto-installs. Scope bounds that travel WITH the claim: (a) the twitter gap is narrower than 6/6 suggests — native also passed 2 of those 6 via third-party mirrors, so the channel earns its place only on tweets nothing mirrors; (b) reddit tier 2 is on an announced closing path and ships with a kill-switch keyed on an OBSERVED login wall; (c) youtube-transcripts is PARKED, not shipped — its backend is human-installed by contract and was never exercised; (d) residential network is load-bearing, and CI is explicitly not a bench environment. | quant | `docs/benchmark.md#ship-gated-reach` | ✅ |
+| 23 host agents are detected and inventoried; 20 receive a written config surface (18 projection + 1 plugin + 1 bundle target) and 3 are export-only (aider, zed, jetbrains). The count is enforced, not asserted — `knownToolIds()` is pinned at 23 by a test whose assertion literal IS the number, and `src/config/surface-matrix.yml` is held in set-equality with the installer's own user-scope path map by `lint_surface_matrix`, so a host added to one and not the other fails the build. This entry stood `unbacked` while naming its own unblocking condition ("once `surface-matrix.yml` exists, bind the count to that file and flip"); the condition was met and nothing fired, so the shipped figure stayed "7+" — understating real coverage by 3x. | quant | `exec:vitest run tests/install/toolDetection.test.ts -> 0` | ✅ |
 | On the fixture corpus (n = 20 before/after pairs, 16 length-controlled within ±25%), the humanizer pass removes every mechanically detected AI-writing tell (mean hard hits 0.9 → 0, cluster score 53.97 → 0 per 500 words, dash density 9.22 → 0), and a blind judge (claude-sonnet-4-5, deterministic per-pair A/B seed) preferred the humanized text in 16/16 length-controlled pairs. Scope note — the "before" fixtures were deliberately tell-seeded, so this measures seeded-tell removal on a self-constructed corpus, NOT real-draft improvement; real-world lift is unmeasured until step 4b has processed real ghostwriter drafts (see the road-to-humanizer-hardening live-usage blocker). | quant | `internal/bench/reports/humanizer-v1.md#prefers the humanized text` | ✅ |
-| A hand-rolled, dependency-free BM25 + trigram lexical index resolves the "recalls but does not rank" gap: on the retrieval-precision corpus (9 keyword-overlapping-confuser tasks) it drives the mean top tie-set from 3.333 (the `_score` bucket scorer) to 1.0 — every needed decision uniquely top-ranked — with precision@1 and precision@5 unchanged at 1.0. Method: deterministic, model-free re-ranking of the SAME retrieved entry set; both scorers measured over the identical store via `measure_lexical_ranking.ts`. | quant | `internal/bench/reports/lexical-ranking.json` | ✅ |
+| NONE of the backed ledger claims are machine-re-verifiable today — every evidence pointer is checked for existence (file present, substring present, URL carries a date), never for truth, so a claim pointing at a stale artefact stays backed indefinitely. A measured minority COULD carry a re-executing `exec:` form, clearing the >= 10 pp threshold that was pre-registered before the count was taken, which is why that form is scheduled rather than assumed. The rest cannot: paid or stochastic benchmark runs no CI job can re-derive, and prose contracts. Exact counts live in the evidence file and are NOT restated here on purpose — this entry hard-coded its denominator twice and drifted within a day both times (25 when the ledger held 26, then 26 when it held 27) while CI stayed green, because the pointer resolved. `check_claims` now compares the stored denominator against the live ledger and fails on divergence. A number a human retypes on every ledger edit will drift; the fix was to stop retyping it. | quant | `internal/reports/exec-evidence-feasibility.json#"exec_feasible"` | ✅ |
+| A hand-rolled, dependency-free BM25 + trigram lexical index resolves the "recalls but does not rank" gap: on the retrieval-precision corpus (9 keyword-overlapping-confuser tasks) it drives the mean top tie-set from 3.333 (the `_score` bucket scorer) to 1.0 — every needed decision uniquely top-ranked — with precision@1 and precision@5 unchanged at 1.0. Method: deterministic, model-free re-ranking of the SAME retrieved entry set; both scorers measured over the identical store via `measure_lexical_ranking.ts`. Cross-artefact note (2026-07-25): this baseline (3.333) is the value in THIS claim's own artefact and is cited correctly, but the retrieval-precision artefact records 4.111 for the same scorer on the same corpus — two bench scripts disagree. The lift direction (ties collapse to 1.0) holds under either baseline; the discrepancy itself is unresolved and recorded rather than smoothed. | quant | `exec:measure_lexical_ranking -> 0` | ✅ |
 | The whole layer is compiled into host agents with zero runtime daemon. | qual | `docs/contracts/no-runtime-boundary.md#file-first, no-runtime suite` | ✅ |
 | On a 12-fixture option-decision corpus (3 arms × 2 providers, blind rubric judge claude-opus-4-8, pre-registered hypotheses), famous-figure identity framing added nothing beyond the underlying method text (method 5.04 vs figure 4.88, Δ=0.17, sign-test p=0.607), and provider diversity moved judged quality ~15× more than persona identity (provider Δ=2.58 vs identity Δ=0.17); the whole persona layer lifted only +0.08 over bare prompts. Honest null — persona panel-mode stays CUT, evidence-closed. | quant | `internal/bench/reports/persona-placebo.json#honest-null` | ✅ |
 | The only agent layer that publishes the runs where it changed nothing. Deliberately falsifiable — if a reader finds a comparable agent layer publishing its own honest-null benchmark runs, this line updates; that is the point. | comparative | `docs/benchmark.md#honest` | ✅ |
-| On the live end-to-end retrieval benchmark (9 tasks × 3 arms × 3 seeds on claude-haiku, fixture store with keyword-overlapping confusers), the memory retrieval substrate scored precision@5 = 100% (9/9) with 100% poisoned-entry rejection, and the retrieval-on arm passed 27/27 model-scored tasks vs 2/27 with retrieval off and 4/27 with a placebo injection. Known limit stays published: mean tie-set 4.1 means top-k ties break by store order, not relevance (the ADR-116/FTS5 signal). | quant | `internal/bench/reports/second-brain-retrieval.json#retrieval-on` | ✅ |
-| 105 governed rules. | quant | `src/scripts/check_artefact_count_messaging.ts#Artefact-count messaging gate` | ✅ |
+| On the live end-to-end retrieval benchmark (9 tasks × 3 arms × 3 seeds on claude-haiku, fixture store with keyword-overlapping confusers), the memory retrieval substrate scored precision@5 = 100% (9/9) with 100% poisoned-entry rejection, and the retrieval-on arm passed 27/27 model-scored tasks vs 2/27 with retrieval off and 4/27 with a placebo injection. Known limit stays published: mean tie-set 4.111 means top-k ties break by store order, not relevance (the ADR-116/FTS5 signal). SOLE RECORD for this artefact as of 2026-07-25: a second entry (`second-brain-retrieval-precision`) described the same measurement from the precision angle and had drifted to 5/27, 5/27 and tie-set 3.3 — figures absent from the shared artefact. Two entries over one artefact is what allowed them to disagree while both resolved, so the pair was folded into this one. | quant | `internal/bench/reports/second-brain-retrieval.json#retrieval-on` | ✅ |
+| 107 governed rules. | quant | `exec:check_artefact_count_messaging -> 0` | ✅ |
 | On a deterministic multi-session recall corpus, the memory substrate produces a measured, placebo-controlled recall lift — memory-on 27/27 vs no-memory 10/27 and vs equal-byte placebo 9/27 (claude-haiku-4-5, n=9 tasks x 3 seeds, sign test p=0.031 for BOTH pairings). Scoped honestly: this is the context-value upper bound (perfect retrieval on a one-fact-per-task corpus), not retrieval precision under a large store. | quant | `internal/bench/reports/second-brain-delta.json` | ✅ |
-| Removing the perfect-retrieval assumption, the substrate's REAL keyword retrieval recalls the needed decision into the top-5 under keyword-overlapping confusers (precision@5 9/9) and the model disambiguates it from the co-injected confusers — retrieval-on 27/27 vs no-memory 5/27 and vs equal-count placebo 5/27 (claude-haiku-4-5, 9 tasks x 3 seeds, sign test p=0.008 both). Named limit: retrieval RECALLS but does not RANK (mean tie-set 3.3, ties broken by store order, not relevance) — the discrimination gap that motivates the SQLite-FTS5 activation path (ADR-116) at larger scale. | quant | `internal/bench/reports/second-brain-retrieval.json` | ✅ |
-| Every artifact the package ships — source AND the condensed projection that reaches consumers — is machine-scanned in CI for hidden-Unicode, mixed-script-confusable, and instruction-smuggling payloads (the rules-file-backdoor class); a finding blocks the release before `npm publish`, not just the merge. | qual | `.github/workflows/publish-npm.yml#lint_agent_security` | ✅ |
-| 278 skills. | quant | `src/scripts/check_artefact_count_messaging.ts#Artefact-count messaging gate` | ✅ |
+| Every artifact the package ships — source AND the condensed projection that reaches consumers — is machine-scanned in CI for hidden-Unicode, mixed-script-confusable, and instruction-smuggling payloads (the rules-file-backdoor class); a finding blocks the release before `npm publish`, not just the merge. | qual | `exec:lint_agent_security -> 0` | ✅ |
+| 281 skills. | quant | `exec:check_artefact_count_messaging -> 0` | ✅ |
 | Removes only its own keys from a shared host config (matched by JSON-pointer + SHA-256), never a neighbour tool's entries. | qual | `docs/contracts/install-layout.md#JSON-pointer` | ✅ |
 | On the pre-registered 12-fixture defect-finding corpus (three arms, deterministic file-level recall, codex reviewer gpt-5.5), the cross-model team-review arm produced NO recall lift over single-model self-review — all three arms recalled every planted defect (Δ = 0, H1 not met). Honest null, ceiling-limited (recall 1.00 everywhere: the seeded defects are too obvious to discriminate the arms on recall); the only non-null signal is a single self-review false positive on the controversial-but-correct control vs 0 for team/council. No cross-model quality/lift claim binds; team mode stays workflow-value-only. Re-open: a judge-survivable-subtlety corpus or a new model generation. | quant | `internal/bench/reports/defect-finding.json#honest_null` | ✅ |
 | On the A3 orchestration eval (deterministic verify, measured token deltas), the production-validator subagent returned the correct verdict on both fixtures — NOT READY with the exact `file:line` citation on a planted hollow implementation, READY with zero spurious findings on the clean control — while consuming ~45k fewer tokens than the inline-host baseline on each task. Scope: two planted fixtures on a Claude Code host, not a broad hit-rate. | quant | `internal/bench/orchestration/pv-a3-results.md#token_delta_provenance: measured` | ✅ |
 
-**24 backed claim(s)** — all evidence pointers resolve in CI.
+**27 backed claim(s)** — all evidence pointers resolve in CI.
+
+### How many of those re-derive themselves
+
+**10 of 27** backed claims carry `exec:` evidence —
+CI re-runs the command and compares its exit code to the claim, so a
+stale one turns the build red. The other
+**17** rest on a pointer: CI checks that the artefact
+exists and contains what it should, which cannot distinguish a live
+claim from one whose producer nobody has run in months.
+
+That residue is not an oversight, and it is listed rather than rounded
+away. A claim can only re-derive itself when a deterministic command
+carries the verdict in its exit code. These cannot, for the reasons
+given:
+
+| Claim | Why it cannot re-execute |
+|---|---|
+| The release process is documented as an inheritable runbook + succession doc, and the project's bus-factor (tr | prose or contract artefact — no exit code carries the verdict |
+| A MEASURED-BUT-NOT-SHIPPED experiment — the thin rule projection reduced eager rule load 78,513 → 13,881 GPT-t | benchmark output — regenerating it needs paid or stochastic model calls no CI job can re-derive |
+| The first cross-vendor parity pass (5 orchestration-corpus tasks × 2 vendors × 3 repeats, identical prompts vi | benchmark output — regenerating it needs paid or stochastic model calls no CI job can re-derive |
+| On a weak host (claude-haiku-4-5) the package produces a significant, placebo-controlled discipline lift on sc | benchmark output — regenerating it needs paid or stochastic model calls no CI job can re-derive |
+| On the READ-ONLY FAN-OUT slice family, tier-downshifted subagent dispatch (lite/haiku vs session-tier-proxy so | benchmark output — regenerating it needs paid or stochastic model calls no CI job can re-derive |
+| The lift-carrying essential cut (kernel + downstream-changes) keeps a significant weak-host discipline lift at | benchmark output — regenerating it needs paid or stochastic model calls no CI job can re-derive |
+| A credential-free prescription layer reads content the host's own web tools cannot fetch at all — Reddit threa | benchmark output — regenerating it needs paid or stochastic model calls no CI job can re-derive |
+| On the fixture corpus (n = 20 before/after pairs, 16 length-controlled within ±25%), the humanizer pass remove | benchmark output — regenerating it needs paid or stochastic model calls no CI job can re-derive |
+| NONE of the backed ledger claims are machine-re-verifiable today — every evidence pointer is checked for exist | prose or contract artefact — no exit code carries the verdict |
+| The whole layer is compiled into host agents with zero runtime daemon. | prose or contract artefact — no exit code carries the verdict |
+| On a 12-fixture option-decision corpus (3 arms × 2 providers, blind rubric judge claude-opus-4-8, pre-register | benchmark output — regenerating it needs paid or stochastic model calls no CI job can re-derive |
+| The only agent layer that publishes the runs where it changed nothing. Deliberately falsifiable — if a reader  | benchmark output — regenerating it needs paid or stochastic model calls no CI job can re-derive |
+| On the live end-to-end retrieval benchmark (9 tasks × 3 arms × 3 seeds on claude-haiku, fixture store with key | benchmark output — regenerating it needs paid or stochastic model calls no CI job can re-derive |
+| On a deterministic multi-session recall corpus, the memory substrate produces a measured, placebo-controlled r | benchmark output — regenerating it needs paid or stochastic model calls no CI job can re-derive |
+| Removes only its own keys from a shared host config (matched by JSON-pointer + SHA-256), never a neighbour too | prose or contract artefact — no exit code carries the verdict |
+| On the pre-registered 12-fixture defect-finding corpus (three arms, deterministic file-level recall, codex rev | benchmark output — regenerating it needs paid or stochastic model calls no CI job can re-derive |
+| On the A3 orchestration eval (deterministic verify, measured token deltas), the production-validator subagent  | benchmark output — regenerating it needs paid or stochastic model calls no CI job can re-derive |
 
 Artefact counts in public prose (skills, commands, governed rules,
 guidelines, personas) are **generated from source and CI-drift-checked**:
@@ -59,7 +115,7 @@ guidelines, personas) are **generated from source and CI-drift-checked**:
 fails the build on any count-shaped prose mention that drifts from the
 source count — or on two different numbers for the same artefact kind.
 
-We also publish our **debt**: 5 claim(s) are logged as
+We also publish our **debt**: 4 claim(s) are logged as
 `unbacked` inventory in the ledger — not yet bound, and therefore not
 allowed to carry a marker in public prose. Hiding them would be the
 opposite of the point.
@@ -80,11 +136,11 @@ shipping theater; the full per-cell data is committed at
 `internal/bench/reports/persona-placebo.json`.
 
 **Behavioural-eval coverage — the honest baseline.** Skill *quality* is only
-as good as its measurement. Today **42 of 278** skills carry a behavioural
+as good as its measurement. Today **42 of 281** skills carry a behavioural
 `evals.json`; the highest-traffic / highest-cost tiers (default-surface +
 `rich` + routers) are **fully covered (35 of 35)**, the long tail
-(7 of 243) is not. We publish that gap rather than imply
-"278 evaluated skills": coverage is measured per tier
+(7 of 246) is not. We publish that gap rather than imply
+"281 evaluated skills": coverage is measured per tier
 (`./scripts-run src/scripts/skill_eval_coverage`), **CI-ratcheted so it can
 only rise**, and the priority tiers carry a hard **tier floor**: every
 rich / default-surface / router skill MUST have a behavioural eval or an
@@ -151,12 +207,32 @@ that (`task check-comparison`), so this column can never lie.
 
 | Claim | Our evidence | The category | Checkable? |
 |---|---|---|---|
-| No runtime — no background daemon, no state database, no auto-write memory. | [`docs/contracts/no-runtime-boundary.md#file-first`](../docs/contracts/no-runtime-boundary.md) | Swarm-runtime tools in this category ship a background process and/or a state store by design; that is an architectural fact of the runtime approach, not a defect. | ✅ |
+| No resident runtime — no background daemon, no state database or service, no auto-write memory; deterministic, rebuildable file indexes only. | [`docs/contracts/no-runtime-boundary.md#file-first`](../docs/contracts/no-runtime-boundary.md) | Swarm-runtime tools in this category ship a background process and/or a resident state store by design; that is an architectural fact of the runtime approach, not a defect. | ✅ |
 | Capability/benchmark results are published — including the runs where the package changed nothing. | [`docs/benchmark.md`](../docs/benchmark.md) | A category headline figure (e.g. an '84.8%' score) appears across marketing surfaces with no reproducible methodology published — so it cannot be verified either way. | ✅ |
 | Every public claim binds to machine-checked evidence. | [`docs/CLAIMS.md`](../docs/CLAIMS.md) | Marketing claims in this category are not bound to a machine-checked ledger a reader can reproduce. | ✅ |
 | Skills publish their own known limits, each with a witness test. | [`tests/scripts/witness/check_refs_relative_gap.test.ts`](../tests/scripts/witness/check_refs_relative_gap.test.ts) | Published known-limitation surfaces backed by reproducing tests are not a standard artifact in this category. | ✅ |
 | A 30-second single-file wedge exists — one read-only subagent, one command, verdict with file:line — and its promise is a scoped, published eval, not a feature list. | [`internal/bench/orchestration/pv-a3-results.md#token_delta_provenance: measured`](../internal/bench/orchestration/pv-a3-results.md) | Category entry points typically install the full platform (profiles, packs, runtime) before the first felt win; single-artifact entries with a published eval behind the promise are not a standard artifact. | ✅ |
 | The persona-identity question was tested and published as an honest null (identity swap ~zero effect, provider choice ~15x larger) instead of being shipped as theater. | [`internal/bench/reports/persona-placebo.json#honest-null`](../internal/bench/reports/persona-placebo.json) | Named-persona prompts are shipped as a feature across the category without a published A/B separating identity from method. | ✅ |
+| Every upstream-tool install prescription the package ships is version-pinned, intake-recorded, and enforced offline in CI — an unpinned version, a branch/archive install source, or a pipe-remote-to-shell instruction fails the build. | [`src/scripts/validate_reach_prescriptions.ts`](../src/scripts/validate_reach_prescriptions.ts) | Capability layers in this category commonly install themselves and their upstream dependencies from a moving target (a branch archive or an unpinned package) via a piped remote installer; whether any given one pins is observable per repo, but a CI gate that fails the build on an unpinned prescription is not a standard artifact. | ✅ |
+| Platform reads that the host's own web tools cannot perform at all (a refused domain, an HTTP 402) are shipped as credential-free prescriptions whose reliability was measured per channel against a native control, with the thresholds frozen before the run and the narrowing caveat published alongside the pass. | [`docs/benchmark.md#ship-gated-reach`](../docs/benchmark.md) | Reaching gated platforms is commonly solved in this category by asking for an API key or a session cookie, and the capability is asserted from a feature list rather than a per-channel reliability measurement with a native-arm control; publishing the case where the native tools already suffice, next to the pass, is not a standard artifact. | ✅ |
+
+### What each one prevents
+
+The same rows, read as failure modes rather than as comparisons. Each names
+something that goes wrong without the control and carries the identical
+resolvable pointer — a projection of the table above, not a second list to
+keep in sync.
+
+| Without it | The control | Evidence |
+|---|---|---|
+| A background process keeps running after you stop using it, holds state you did not write, and has to be kept alive and upgraded. | No resident runtime — no background daemon, no state database or service, no auto-write memory; deterministic, rebuildable file indexes only. | [`docs/contracts/no-runtime-boundary.md#file-first`](../docs/contracts/no-runtime-boundary.md) |
+| You adopt on a headline number nobody can re-run, and never learn which of its measurements changed nothing. | Capability/benchmark results are published — including the runs where the package changed nothing. | [`docs/benchmark.md`](../docs/benchmark.md) |
+| A shipped number drifts from the artefact it came from and stays published, because nothing re-checks the claim against its source. | Every public claim binds to machine-checked evidence. | [`docs/CLAIMS.md`](../docs/CLAIMS.md) |
+| A limitation is discovered by you, in your repo, at the moment it costs you something — instead of being stated up front and held by a test. | Skills publish their own known limits, each with a witness test. | [`tests/scripts/witness/check_refs_relative_gap.test.ts`](../tests/scripts/witness/check_refs_relative_gap.test.ts) |
+| Evaluating the tool means installing the whole platform first, so the first thing you learn is the setup cost rather than whether it works. | A 30-second single-file wedge exists — one read-only subagent, one command, verdict with file:line — and its promise is a scoped, published eval, not a feature list. | [`internal/bench/orchestration/pv-a3-results.md#token_delta_provenance: measured`](../internal/bench/orchestration/pv-a3-results.md) |
+| You pay tokens for prompt theater that was never measured against the method text it wraps. | The persona-identity question was tested and published as an honest null (identity swap ~zero effect, provider choice ~15x larger) instead of being shipped as theater. | [`internal/bench/reports/persona-placebo.json#honest-null`](../internal/bench/reports/persona-placebo.json) |
+| An install instruction silently follows a moving target — an unpinned package or a piped remote script — so what lands in your repo is whatever the source held that day. | Every upstream-tool install prescription the package ships is version-pinned, intake-recorded, and enforced offline in CI — an unpinned version, a branch/archive install source, or a pipe-remote-to-shell instruction fails the build. | [`src/scripts/validate_reach_prescriptions.ts`](../src/scripts/validate_reach_prescriptions.ts) |
+| You hand over a credential — or your account — for a read the tools could already do, and you cannot tell which channels actually work because the capability was claimed rather than measured. | Platform reads that the host's own web tools cannot perform at all (a refused domain, an HTTP 402) are shipped as credential-free prescriptions whose reliability was measured per channel against a native control, with the thresholds frozen before the run and the narrowing caveat published alongside the pass. | [`docs/benchmark.md#ship-gated-reach`](../docs/benchmark.md) |
 
 ## 5. Verify it yourself
 

package/docs/threat-model.md

@@ -17,6 +17,7 @@ and holds no user data. Threats are about **artifact integrity** and
 | e | **Malicious metadata / frontmatter injection** — a PR embeds hostile YAML in a skill's frontmatter (e.g. injecting a trigger keyword that causes a dangerous skill to fire in unintended contexts, or adding `permissionMode: bypassPermissions`) | PR contributor adds `permissionMode: bypassPermissions` or a wildcard `allowed_tools: ["*"]` entry to an existing skill's frontmatter; or crafts a trigger keyword to hijack routing | `lint_skill_frontmatter_safety.py` — HIGH-severity block on `bypassPermissions`, wildcard `allowed_tools`, unsafe `execution.type: automated` without safety floor; `lint_hidden_unicode.py` — catches invisible chars inside frontmatter YAML values; PR review gate; `scripts/validate_frontmatter.py` schema validation | Schema validation does not verify trigger-keyword semantic safety (a plausible keyword that causes over-broad firing is not caught) | Extend `validate_frontmatter.py` to flag trigger keywords that match security-sensitive path prefixes (e.g. a skill triggering on `"auth"` when it has `execution.type: automated`) |
 | f | **Skill self-update — safety-floor rewrite** — an agent is social-engineered (via chat or a PR) into weakening a kernel rule, safety floor, or MCP/tool allowlist | A PR removes the Iron Law block from `non-destructive-by-default.md`; or a chat prompt instructs the agent to edit `security-sensitive-stop.md` to narrow its self-modification clause; or a PR modifies `scope-control` to remove the Hard Floor | `src/rules/security-sensitive-stop.md` — "self-modification via chat" clause: requests to weaken safety floors / kernel rules / MCP allowlists must route through `scope-control` gates; `src/rules/scope-control.md` — kernel-rule edits require own PR + ≥ 24 h soak; `dist/agent-src/` is read-only (source-of-truth rule); `scripts/check_condensation.py` detects Iron-Law section deletion or downgrade | No automated per-rule diff check that fires specifically when a kernel rule's Iron Law section is removed; relies on PR reviewer recognising the file class | Add a CI check (`scripts/check_kernel_rule_integrity.py` — P3+) that asserts Iron Law fenced-code blocks survive unchanged in all files listed in `docs/contracts/kernel-membership.md` |
 | g | **Subprocess spawn-env inheritance** — AC's own transport spawns an external CLI (the AI-council provider CLIs; consumer-runtime hooks spawn `git`) with the full parent `process.env`, so an attacker-influenced env var in the parent becomes RCE when the child (or a `git` it invokes internally) runs | A poisoned `GIT_EXTERNAL_DIFF` / `core.pager` / `GIT_SSH_COMMAND`, the `GIT_CONFIG_COUNT`/`_KEY_<n>`/`_VALUE_<n>` config-injection trio (sets `core.fsmonitor` → shell on every `git status`), a dynamic-loader `LD_PRELOAD` / `DYLD_INSERT_LIBRARIES` / `GCONV_PATH`, `GIT_ALTERNATE_OBJECT_DIRECTORIES` / `HOSTALIASES`, or a runtime hook `NODE_OPTIONS` / `BASH_ENV` / `PYTHONSTARTUP` present in the parent env executes attacker code inside the spawned process (CWE-426, CWE-88, CWE-427) | `src/scripts/_lib/spawn_env.ts::hardenedSpawnEnv()` scrubs the code-execution-injection env families (deny-by-family: loader `LD_*`/`DYLD_*`/`GCONV_PATH`, git `*_COMMAND` + the whole `GIT_CONFIG`/`GIT_CONFIG_*` family + `GIT_ALTERNATE_OBJECT_DIRECTORIES`/`HOSTALIASES`/`GIT_EXTERNAL_DIFF`/`GIT_SSH_COMMAND`/`GIT_PAGER`/`PAGER`, runtime hooks `NODE_OPTIONS`/`BASH_ENV`/`ENV`/`PYTHON*`/`PERL5*`/`RUBYOPT`, `IFS`) and preserves the rest; wired into ALL consumer-runtime spawns — `clients.ts::_runSubprocess`, `hooks/dispatch_hook.ts`, `roadmap_progress_hook.ts`, `hot_context_hook.ts`; falsifiable regression test in `tests/scripts/ai_council/spawn_env.test.ts` (ADR-123 + 2026-07-21 follow-up) | — (consumer-runtime surface fully hardened; maintainer/CI/install sites are env-controlled, not attacker-influenced) | Spawn sites classified in `docs/spawn-site-policy.md` (Consumer Runtime MUST harden / Maintainer / CI / install exempt with rationale); the deferred lint was rejected — the policy doc is the self-enforcing substitute |
+| h | **Secret committed to version control** (CWE-798) — a credential (API key, token, private key, DB password) is written into a tracked file and committed/pushed, leaking it into history, clones, forks, and public scrapers; `git rm` does not un-leak it | An agent (or developer) pastes or generates a real credential into source, `.env`, config, or a fixture and commits it; once pushed to a public remote it is scraped within minutes | `src/rules/secret-vcs-guard.md` (agent-side write/commit-time block → ask → tiered alternative → rotate-first, VCS-agnostic); `src/scripts/_lib/secret_detector.ts` (regex rule pack + Shannon entropy + keyword detector); `src/scripts/check_secret_leak.ts` wired into `task ci` / `ci-strict` as the diff-scoped, non-bypassable CI net; `src/agent-src/templates/github-workflows/secret-scan.yml` (gitleaks) consumer template | The agent-side gate covers only what the agent writes and is one layer; developer-side / GUI commits need the CI net or host push-protection, which the consumer must enable | Ship + document the `secret-scan.yml` template; recommend enabling GitHub Secret Scanning + Push Protection; the optional TruffleHog step adds live-credential verification. Canonical reference: `secret-vcs-guard.md` + `skill:secrets-management` — do not re-describe here |
 
 ## Review cadence
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@event4u/agent-config",
-    "version": "9.7.0",
+    "version": "9.8.0",
     "description": "Universal AI Agent OS — audited skills, governance rules, commands and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
     "license": "MIT",
     "private": false,
@@ -71,7 +71,8 @@
         "test:ts": "vitest run",
         "prepack": "npm run build && npm run build:discovery && npm run build:mcp-manifest && node src/scripts/prepack-check.mjs",
         "prepublishOnly": "./scripts-run src/scripts/check_release_includes_discovery",
-        "prepare": "[ -d .git ] && bash src/scripts/install-hooks.sh || true"
+        "prepare": "[ -d .git ] && bash src/scripts/install-hooks.sh || true",
+        "postinstall": "node dist/scripts/postinstall_gui.js 2>/dev/null || true"
     },
     "publishConfig": {
         "access": "public",
@@ -103,7 +104,9 @@
         "js-yaml": "^4.1.0",
         "open": "^10.2.0",
         "preact": "^10.29.0",
+        "tree-sitter-wasms": "0.1.13",
         "tsx": "^4.22.3",
+        "web-tree-sitter": "0.24.7",
         "yaml": "^2.9.0",
         "zod": "^3.25.0",
         "zod-to-json-schema": "^3.25.0"

package/src/config/agent-settings.template.yml

@@ -546,6 +546,39 @@ consistency:
   #        reading of whichever source it happened to read).
   cross_source: "on"
 
+# --- Documentation screenshots ---
+#
+# When the agent creates screenshots for documentation (e.g. generating a docs
+# site) and embeds them, sensitive data visible on the screenshot MUST be
+# anonymized / pixelated before it ships. Consumed by the `doc-screenshot-hygiene`
+# rule and the `screenshot-hygiene` skill. Automated detection is a helper that
+# flags + pre-redacts — never a clearance; the gate for a data-bearing screenshot
+# is human confirmation (routing into `non-destructive-by-default`, since a
+# shipped screenshot is an irreversible published egress).
+screenshots:
+  # Public identity tokens that are SAFE to show unredacted — the maintainer's
+  # OWN public handles (e.g. a username shown in an admin panel) plus well-known
+  # fake-data tokens. This is NOT a general fake-data dictionary and NOT
+  # identity-resolution: everything not on this list is treated as sensitive by
+  # default. A public handle co-located with a real name does NOT whitelist the
+  # real name. Default: [] (nothing auto-allowed; every identity is human-decided).
+  identity_allowlist: []
+
+  # true | false  (default: true)
+  # true  = terminal / CLI / IDE screenshots are FORBIDDEN (highest leak vector:
+  #         absolute local paths, env tokens). Use text code blocks with text
+  #         redaction instead.
+  # false = allowed, but still subject to the data-bearing human gate.
+  forbid_terminal_capture: true
+
+  # on | off  (default: on)
+  # on  = a data-bearing screenshot embed is gated behind this-turn human
+  #       confirmation; uncertain/unresolved regions → redact-or-refuse, never
+  #       ship-and-hope. Illustrative / no-data screenshots (diagrams, logos,
+  #       placeholder-only UI) may embed with a stated justification.
+  # off = no data-bearing gate (legacy; the anonymization taxonomy still applies).
+  data_bearing_gate: "on"
+
 code_style:
   # minimal | full  (default: minimal)
   #
@@ -1007,6 +1040,16 @@ hooks:
   design_slop:
     enabled: false
 
+  # PreToolUse code-graph nudge (ADR-124 Phase 4). Default-OFF. When enabled
+  # AND a native code-graph engine has built a cache (or the repo ships a
+  # graph.json / SCIP index), WARNS once per session (exit 2, never blocks) as
+  # the agent is about to Grep/Glob or Read a source file: query the graph
+  # first for "who calls / where used / impact" questions (or rebuild if the
+  # index is stale, or build one if absent). Source G's strict block-first-read
+  # mode is deliberately un-ported. Build the cache with `code_graph build`.
+  code_graph:
+    enabled: false
+
 # --- Decision engine ---
 #
 # Controllable gates layered over the observability surface. Absent

package/src/config/reach-channels.yml

@@ -0,0 +1,217 @@
+# Reach channel registry — standalone operator tooling
+# (road-to-internet-reach Phase 1).
+#
+# WHAT THIS FILE IS. A machine-checked answer to three operator questions:
+# which external backend does a reach recipe need, is that backend healthy,
+# and is its install command pinned. Schema:
+# src/scripts/schemas/reach-channels.schema.json; gate:
+# `task check-reach-channels`.
+#
+# WHAT THIS FILE IS NOT. Not a routing table, not a recommendation, not an
+# agent-facing surface. The Phase 0 pre-registered benchmark returned
+# `band: stop` (native arm 12/12, reach arm 0 outright wins), so no router
+# skill ships and NO channel below is routed, preferred, or suggested to an
+# agent. Reading a channel here as "the agent should use this" is a
+# misreading of the verdict.
+#
+# BACKEND ORDER IS THE SWITCH. `backends:` is an ordered candidate list —
+# each entry satisfies the channel on its own (an alternative, never a
+# pipeline stage). Changing the preferred candidate is reordering this list,
+# never editing code. Channel order carries no meaning.
+#
+# LIFECYCLE VOCABULARY IS BORROWED, NOT FORKED. `lifecycle:` uses the four
+# values from docs/contracts/provider-lifecycle.md (`experimental | stable |
+# deprecated | community`). `stable` here means the same thing it means
+# there: a maintainer exercised it against a real run at least once.
+#
+# PINNING IS LOAD-BEARING. Every `install:` string is either an explicitly
+# version-pinned command or an `os-baseline:` sentinel (see below). Moving
+# targets — `latest`, `main`, `master`, `HEAD`, archive/tarball URLs — are
+# rejected by the schema pattern, not by good intentions. The package never
+# executes these strings: a human reads and runs them.
+#
+# OS BASELINES ARE NOT PACKAGE INSTALLS. `curl` and `node` are assumed
+# present: they ship with the OS or the developer's base image. Their
+# prescriptions therefore name the platform's own package manager and stay
+# unpinned wherever a version pin is not meaningful, marked with the
+# explicit `os-baseline:` sentinel so the absence of a pin is a declared
+# decision rather than an oversight. Where a pin IS meaningful — Node's
+# major line — a real versioned formula is used.
+#
+# `jq` IS DELIBERATELY NOT A BACKEND. JSON shaping happens inside the
+# operator's own recipe, downstream of retrieval; it is not a candidate
+# that satisfies a channel. If it ever becomes one, it inherits the same
+# `os-baseline:` convention as curl.
+#
+# PIN PROVENANCE (looked up 2026-07-24, never invented):
+#   gh 2.96.0      — `gh --version` on the authoring machine, corroborated by
+#                    https://api.github.com/repos/cli/cli/releases/latest
+#                    (tag_name v2.96.0) and
+#                    https://formulae.brew.sh/api/formula/gh.json (stable 2.96.0).
+#   yt-dlp 2026.7.4 — https://pypi.org/pypi/yt-dlp/json (.info.version).
+#   node@22        — https://formulae.brew.sh/api/formula/node@22.json
+#                    (versioned formula exists; stable 22.23.1 at lookup time).
+#   asdf plugin `github-cli` — exists in the asdf plugin index
+#                    (raw.githubusercontent.com/asdf-vm/asdf-plugins → plugins/github-cli).
+#                    Homebrew has no versioned `gh` formula, so an exactly
+#                    pinned macOS/Linux prescription goes through asdf.
+#   winget id `GitHub.cli` version 2.96.0 — present in the winget-pkgs manifest
+#                    tree (api.github.com/repos/microsoft/winget-pkgs/contents/
+#                    manifests/g/GitHub/cli lists 2.96.0).
+#
+# `last_verified:` MUST stay quoted — an unquoted ISO date parses as a
+# timestamp, not a string, and fails the schema type check.
+schema_version: reach-channels-v1
+
+channels:
+  # Repository metadata: issues, PRs, releases, workflow runs, raw file reads.
+  # `free-key`: unauthenticated GitHub API access is rate-limited hard enough
+  # that a token is the practical floor. The token is operator-provisioned;
+  # nothing here reads, stores, or forwards it.
+  - id: github
+    description: Repository, issue, release and workflow metadata from the GitHub API.
+    tier: free-key
+    lifecycle: stable
+    override_key: reach.channels.github.backend
+    last_verified: "2026-07-24"
+    backends:
+      - id: gh
+        probe_cmd: gh
+        probe_args: ["--version"]
+        install:
+          darwin: asdf plugin add github-cli && asdf install github-cli 2.96.0
+          linux: asdf plugin add github-cli && asdf install github-cli 2.96.0
+          win32: winget install --id GitHub.cli --version 2.96.0
+          default: asdf plugin add github-cli && asdf install github-cli 2.96.0
+
+  # Video metadata and subtitle tracks. `yt-dlp` is NOT installed on the
+  # authoring machine, and that is expected: this file is validated offline
+  # against the schema only, so an absent backend cannot fail the gate. Its
+  # health is the probe layer's question, never the registry's.
+  # `experimental` for exactly that reason — the shape is right, no
+  # maintainer has exercised this backend against a real run.
+  - id: youtube
+    description: Video metadata and subtitle tracks for a public video URL.
+    tier: zero-config
+    lifecycle: experimental
+    override_key: reach.channels.youtube.backend
+    last_verified: "2026-07-24"
+    backends:
+      - id: yt-dlp
+        probe_cmd: yt-dlp
+        probe_args: ["--version"]
+        install:
+          darwin: pipx install yt-dlp==2026.7.4
+          linux: pipx install yt-dlp==2026.7.4
+          win32: py -m pipx install yt-dlp==2026.7.4
+          default: pipx install yt-dlp==2026.7.4
+
+  # Feed retrieval. Two independent candidates: fetch the feed with curl, or
+  # fetch-and-parse it in a Node one-liner. Either satisfies the channel.
+  - id: rss
+    description: Atom and RSS feed retrieval for a known feed URL.
+    tier: zero-config
+    lifecycle: stable
+    override_key: reach.channels.rss.backend
+    last_verified: "2026-07-24"
+    backends:
+      - id: curl
+        probe_cmd: curl
+        probe_args: ["--version"]
+        install:
+          darwin: "os-baseline: macOS ships curl (8.7.1 observed 2026-07-24) at /usr/bin/curl — no package install prescribed"
+          linux: "os-baseline: distro-provided curl package (apt / dnf / apk) — version tracks the distro, no pin meaningful"
+          win32: "os-baseline: Windows 10+ ships curl.exe in System32 — no package install prescribed"
+          default: "os-baseline: a system curl is assumed present; if absent, install it from the platform package manager — never a piped remote installer"
+      - id: node
+        probe_cmd: node
+        probe_args: ["--version"]
+        install:
+          darwin: brew install node@22
+          linux: "os-baseline: distro or NodeSource nodejs package — version tracks the chosen channel, no pin meaningful here"
+          win32: "os-baseline: winget package OpenJS.NodeJS.LTS — version tracks the LTS line, no pin meaningful here"
+          default: "os-baseline: any Node runtime at or above this package's engines floor (>=20.11.0) already on PATH"
+
+  # Single-page read. Same two candidates as `rss`: curl fetches the bytes;
+  # Node covers the case where the extraction step runs in-process.
+  - id: web-read
+    description: Single public web page fetch for a URL the operator already has.
+    tier: zero-config
+    lifecycle: stable
+    override_key: reach.channels.web-read.backend
+    last_verified: "2026-07-24"
+    backends:
+      - id: curl
+        probe_cmd: curl
+        probe_args: ["--version"]
+        install:
+          darwin: "os-baseline: macOS ships curl (8.7.1 observed 2026-07-24) at /usr/bin/curl — no package install prescribed"
+          linux: "os-baseline: distro-provided curl package (apt / dnf / apk) — version tracks the distro, no pin meaningful"
+          win32: "os-baseline: Windows 10+ ships curl.exe in System32 — no package install prescribed"
+          default: "os-baseline: a system curl is assumed present; if absent, install it from the platform package manager — never a piped remote installer"
+      - id: node
+        probe_cmd: node
+        probe_args: ["--version"]
+        install:
+          darwin: brew install node@22
+          linux: "os-baseline: distro or NodeSource nodejs package — version tracks the chosen channel, no pin meaningful here"
+          win32: "os-baseline: winget package OpenJS.NodeJS.LTS — version tracks the LTS line, no pin meaningful here"
+          default: "os-baseline: any Node runtime at or above this package's engines floor (>=20.11.0) already on PATH"
+
+  # Discussion search over the public Hacker News search API. Keyless, and
+  # the endpoint returns JSON directly — one candidate is enough.
+  - id: hackernews
+    description: Discussion and comment search over the public Hacker News search API.
+    tier: zero-config
+    lifecycle: stable
+    override_key: reach.channels.hackernews.backend
+    last_verified: "2026-07-24"
+    backends:
+      - id: curl
+        probe_cmd: curl
+        probe_args: ["--version"]
+        install:
+          darwin: "os-baseline: macOS ships curl (8.7.1 observed 2026-07-24) at /usr/bin/curl — no package install prescribed"
+          linux: "os-baseline: distro-provided curl package (apt / dnf / apk) — version tracks the distro, no pin meaningful"
+          win32: "os-baseline: Windows 10+ ships curl.exe in System32 — no package install prescribed"
+          default: "os-baseline: a system curl is assumed present; if absent, install it from the platform package manager — never a piped remote installer"
+
+  - id: reddit
+    description: Reddit discussion reading in two tiers — durable Atom text, and time-bounded ranked HTML.
+    tier: zero-config
+    lifecycle: experimental
+    override_key: reach.channels.reddit.backend
+    last_verified: "2026-07-25"
+    backends:
+      - id: curl
+        probe_cmd: curl
+        probe_args: ["--version"]
+        install:
+          darwin: "os-baseline: macOS ships curl (8.7.1 observed 2026-07-25) at /usr/bin/curl — no package install prescribed"
+          linux: "os-baseline: distro-provided curl package (apt / dnf / apk) — version tracks the distro, no pin meaningful"
+          win32: "os-baseline: Windows 10+ ships curl.exe in System32 — no package install prescribed"
+          default: "os-baseline: a system curl is assumed present; if absent, install it from the platform package manager — never a piped remote installer"
+      - id: node
+        probe_cmd: node
+        probe_args: ["--version"]
+        install:
+          darwin: brew install node@22
+          linux: "os-baseline: distro or NodeSource nodejs package — version tracks the chosen channel, no pin meaningful here"
+          win32: "os-baseline: winget package OpenJS.NodeJS.LTS — version tracks the LTS line, no pin meaningful here"
+          default: "os-baseline: any Node runtime at or above this package's engines floor (>=20.11.0) already on PATH"
+
+  - id: twitter-oembed
+    description: Single public tweet read through the platform's own oEmbed endpoint, credential-free.
+    tier: zero-config
+    lifecycle: experimental
+    override_key: reach.channels.twitter-oembed.backend
+    last_verified: "2026-07-25"
+    backends:
+      - id: curl
+        probe_cmd: curl
+        probe_args: ["--version"]
+        install:
+          darwin: "os-baseline: macOS ships curl (8.7.1 observed 2026-07-25) at /usr/bin/curl — no package install prescribed"
+          linux: "os-baseline: distro-provided curl package (apt / dnf / apk) — version tracks the distro, no pin meaningful"
+          win32: "os-baseline: Windows 10+ ships curl.exe in System32 — no package install prescribed"
+          default: "os-baseline: a system curl is assumed present; if absent, install it from the platform package manager — never a piped remote installer"