@event4u/agent-config 9.7.0 → 9.9.0

package/docs/contracts/command-surface-tiers.md

@@ -1,176 +0,0 @@
----
-stability: beta
-keep-beta-until: 2026-08-12
----
-
-
-# Command Surface Tiers
-
-> **Status:** Active. Defines the tiering contract for the two
-> command surfaces this package ships:
->
-> - **CLI commands** rendered by `./agent-config --help`.
-> - **Slash commands** under `.agent-src.uncondensed/commands/**`.
->
-> Per Phase 4 of the distribution-maturity roadmap (see
-> `agents/roadmaps/` for current status).
-
-## Why tiering
-
-`./agent-config --help` currently prints 45 CLI commands; the slash
-surface ships 106 files (52 root + 54 orchestrator children). A new
-contributor running `--help` reads a wall of operational, hook, and
-maintenance commands before they find `init / sync / validate / work`.
-Tiering separates **the path a new contributor walks** (Tier-0) from
-**power-user workflows** (Tier-1) from **hook / maintenance / internal**
-(Tier-2).
-
-## The three tiers
-
-### Tier-0 — daily-driver
-
-The path a new contributor walks on day one. Visible in
-`./agent-config --help` by default. Visible at the top of any
-`/agents audit` listing.
-
-**Membership criteria — ALL must hold:**
-
-1. **First-week need.** A solo contributor hitting the package for
-   the first time will run this within their first five sessions
-   without being told.
-2. **Stable surface.** The command name + flag set has not changed
-   in the last two minor releases (or is brand-new with a
-   commitment to two-release stability).
-3. **No prerequisite tooling beyond `bash` + `node`.** Docker,
-   GPG, jq, gh CLI, npm globals are all Tier-1+ territory.
-4. **Cited in the `init → sync → validate → work` outcome path.**
-   Setup helpers (`first-run`, `keys:install-*`) and AI-Council entry
-   points (`council:*`) are **not** Tier-0 — they are run once-per-
-   project or on-demand, not in the daily loop. They live at Tier-1.
-
-**Canonical Tier-0 members (2026-05-13, post-`road-to-surface-discipline`):**
-
-- CLI: `init`, `sync`, `validate`, `work`, `implement-ticket`,
-  `help`, `--version`.
-- Slash: `/onboard`, `/commit`, `/work`, `/implement-ticket`,
-  `/agent-status`, `/agent-handoff`.
-
-### Tier-1 — power-user
-
-Workflows a contributor reaches for in week two or beyond, or
-release / review / audit paths the maintainer team uses. Visible in
-`./agent-config --help --tier=1` and in `/agents audit`'s expanded
-view. Documented in the same surface as Tier-0.
-
-**Membership criteria — ANY suffices:**
-
-1. **Repeat workflow, not first-week.** Used by every contributor
-   eventually but not on day one (`/create-pr`, `/review-changes`,
-   `/optimize`).
-2. **Maintainer-team gate.** Release-shape commands, audits,
-   migration helpers (`update`, `versions`, `prune`, `doctor`,
-   `export`, `migrate`, `uninstall`).
-3. **Orchestrator dispatch surface.** Top-level slash orchestrators
-   whose children carry the actual work (`/roadmap`, `/feature`,
-   `/fix`, `/judge`, `/memory`, `/optimize`, `/council`).
-4. **Once-per-project or on-demand setup helper.** Commands invoked
-   to bootstrap or rotate credentials, not in the daily loop
-   (`first-run`, `keys:install-anthropic`, `keys:install-openai`,
-   `council:estimate`, `council:run`, `council:render`).
-
-**Canonical Tier-1 CLI members (2026-05-13, post-`road-to-surface-discipline`):**
-
-`update`, `versions`, `global`, `export`, `uninstall`, `prune`,
-`doctor`, `migrate`, `first-run`, `keys:install-anthropic`,
-`keys:install-openai`, `council:estimate`, `council:run`,
-`council:render`.
-
-**Surface-trim changelog (2026-05-13):** Six CLI commands moved
-Tier-0 → Tier-1: `first-run` (run once per project), `keys:install-anthropic` /
-`keys:install-openai` (one-time credential setup), `council:estimate` /
-`council:run` / `council:render` (on-demand review tool, not daily
-driver). Commands stay invokable by full name; only `--help`
-surfacing changed.
-
-### Tier-2 — maintenance / internal
-
-Default for new commands. Hidden from `./agent-config --help`
-unless `--tier=all`. Reachable by full name; not advertised.
-
-**Membership criteria — ANY suffices:**
-
-1. **Hook entry point.** `*-hook` commands wired by the platform
-   (`chat-history:hook`, `dispatch:hook`,
-   `roadmap-progress:hook`, `onboarding-gate:hook`,
-   `context-hygiene:hook`, `hooks:install`, `hooks:status`).
-2. **Internal / programmatic.** Called by other scripts or by the
-   work-engine, never typed by a human (`memory:*`,
-   `proposal:check`, `refine-ticket:detect`,
-   `telemetry:*`, `mcp:render`, `mcp:check`, `mcp:setup`,
-   `mcp:run`, `roadmap:progress-check`).
-3. **Sub-command of a slash orchestrator** — the orchestrator is
-   Tier-1; the children are Tier-2 because they are invoked via
-   the orchestrator's menu, not by name.
-4. **Anything else.** Default for new commands; promotion is the
-   harder direction.
-
-## Promotion gate (Tier-2 → Tier-1, Tier-1 → Tier-0)
-
-Promotion is **not implicit**. Each promotion requires:
-
-1. A short ADR under `docs/decisions/` citing this contract and
-   the specific criterion satisfied.
-2. The frontmatter `tier:` change in the same commit as the ADR.
-3. CI green (`tests/test_command_surface_tiers.py` + `task ci`).
-
-Demotion is allowed without ADR (Tier-0 → Tier-1, Tier-1 → Tier-2)
-but must update this contract's canonical list.
-
-## Tagging shape
-
-Slash commands carry tier in YAML frontmatter:
-
-```yaml
----
-name: commit
-tier: 0
-description: Stage and commit all uncommitted changes …
----
-```
-
-CLI commands carry tier in the `agent-config` heredoc, by section —
-the help text groups commands under `## Tier 0`, `## Tier 1`,
-`## Tier 2 (hidden by default)` headings rendered by
-`./agent-config --help --tier=all`.
-
-## Drift / lint
-
-`scripts/lint_command_tiers.py` enforces:
-
-1. Every file under `.agent-src.uncondensed/commands/**.md` has
-   a `tier:` frontmatter key whose value is `0`, `1`, or `2`.
-2. Every command listed under `## Tier 0` / `## Tier 1` /
-   `## Tier 2` in this contract resolves to a real command file or
-   a real CLI command name.
-3. No command appears in two tier lists in this contract.
-
-Hooked into `task lint-skills` so it runs in CI.
-
-## `tier` deprecation signal (discovery manifest v2)
-
-Since ADR-090 the named `visibility:` field is the command classifier source
-of truth and the integer `tier:` (`0/1/2`) is a back-compat alias. The
-published discovery manifest (`dist/discovery/discovery-manifest.json`) is now
-**v2** and carries a machine-readable top-level `deprecations` block
-announcing the `tier` key (replacement: `visibility`). `tier` is **still
-emitted** on command artefacts (non-breaking) — the block only signals the
-deprecation so external manifest consumers can migrate during a soak window.
-Removal of `tier` (frontmatter + schema + manifest emit) is tracked in
-`road-to-tier-removal` (ADR-092, Phase 4) and is **not** done yet; restoring
-`tier` after removal would be a sub-1h manifest-schema patch.
-
-## See also
-
-- The distribution-maturity roadmap — Phase 4 (under `agents/roadmaps/`).
-- `docs/contracts/command-clusters.md` — orchestrator → child wiring.
-- `docs/contracts/STABILITY.md` — surface-stability commitments.

package/docs/contracts/command-taxonomy.md

@@ -1,137 +0,0 @@
----
-stability: beta
-keep-beta-until: 2026-08-12
----
-
-# Command taxonomy
-
-> **Status:** beta — first draft 2026-05-16 (Phase 2 Item 6 of
-> `step-15-product-refinement`).
-
-The taxonomy answers **"how is the command surface organized so each
-profile finds their three first commands in under 30 seconds?"** It is
-a **catalog-organization contract**, not an invocation-rename. Existing
-slash invocations (`/work`, `/fix ci`, `/research deep`) are preserved
-by the locked verb-cluster contract at
-[`command-clusters`](command-clusters.md). This file adds a **profile
-axis** on top of the verb axis without breaking either.
-
-## The two axes
-
-| Axis | Owner | Surface |
-|---|---|---|
-| **Verb-cluster** (existing) | [`command-clusters`](command-clusters.md) | Defines the invocation tree (`/fix ci` dispatches to the `ci` sub-command of the `fix` cluster). Linter-enforced. **Source of truth for invocation.** |
-| **Profile** (this contract) | [`profile-system`](profile-system.md) | Defines which verb-clusters and sub-commands are surfaced first for each profile (developer · content_creator · founder · agency · finance · ops). **Source of truth for discoverability.** |
-
-A command can be discoverable under multiple profiles. `/work` is
-universal — it appears in `commands_hint` for every profile. `/dcf-modeling`
-is finance-only. Discoverability is many-to-many; invocation stays
-single-source.
-
-## Membership rules
-
-### Profile membership
-
-A command appears in a profile's `commands_hint` (in
-`.agent-src.uncondensed/profiles/<id>.yml`) iff **all** hold:
-
-1. **First-week reach.** A user of that profile will reach for this
-   command within their first five sessions without being told.
-2. **Profile-coherent.** The command's domain matches the profile's
-   primary work surface (engineering for `developer`, content for
-   `content_creator`, etc.).
-3. **Verb-cluster owned.** The command exists in `command-clusters` —
-   no profile may declare a command that has not gone through the
-   verb-cluster linter.
-4. **Cap of five.** A profile's `commands_hint` is capped at five
-   entries. The cap is what makes "three first commands" possible.
-
-### Top-10 most-used (for alias / deprecation policy)
-
-The top-10 list is the **union of all six profiles' `commands_hint`
-lists, ranked by per-profile membership count**. As of 2026-05-16
-that union is, in rank order:
-
-1. `work` (6/6 profiles)
-2. `implement-ticket` (2/6 — developer, agency)
-3. `feature` (2/6 — founder, agency)
-4. `council` (2/6 — founder, finance)
-5. `challenge-me` (2/6 — founder, finance)
-6. `review-changes` (2/6 — developer, ops)
-7. `fix` (2/6 — developer, ops)
-8. `refine-ticket` (1/6 — agency)
-9. `commit` (1/6 — developer)
-10. `roadmap` (1/6 — agency)
-
-The top-10 is regenerated automatically from the profile YAMLs by
-`scripts/regen_top10.py` (Phase 2 deliverable — not yet shipped). Until
-the regen script lands, the list above is the locked snapshot.
-
-## Backward-compat policy
-
-The top-10 commands carry a **two-release backward-compat guarantee**:
-
-- A rename of any top-10 command (whether by verb-cluster restructure
-  or profile-axis reorganization) ships with an alias for **at least
-  two minor releases**.
-- The alias is recorded in the verb-cluster's `Replaces` column in
-  [`command-clusters`](command-clusters.md) and re-emits a one-line
-  deprecation notice to stderr on every invocation.
-- Removing the alias requires the `bundled-always-rules-acknowledged`
-  PR label and an entry in the CHANGELOG `Removed` section naming the
-  end-of-deprecation release.
-
-Commands outside the top-10 follow the existing verb-cluster
-deprecation rules (one release as a shim, then disappear).
-
-## Discoverability surfaces
-
-Three surfaces consume this contract:
-
-| Surface | Path | What it shows |
-|---|---|---|
-| **README** | `README.md` § "Six entry paths" | Per-profile `commands_hint` (max 5) rendered as the first-commands list per profile block |
-| **Catalog** | `docs/catalog.md` | All commands grouped by verb-cluster (primary axis), with a per-command `profiles:` line listing which profiles surface it |
-| **Wizard** | `.agent-src.uncondensed/commands/onboard.md` | After role selection, prints the five-command starter list from the selected profile's `commands_hint` |
-
-The README and wizard surfaces are already wired. The catalog `profiles:`
-line is a Phase 2 deliverable.
-
-## What this contract does **not** do
-
-- **Does not** rename any command. Invocation stays flat (`/work`, not
-  `/dev/work`). The `/dev/...` / `/ops/...` strawman in the Item 6
-  roadmap entry is **rejected** — adding a profile prefix to invocation
-  would dual-namespace the surface, conflict with verb-cluster cluster
-  heads, and require a 124-command migration with no measurable
-  discoverability gain over the README + wizard surfaces above.
-- **Does not** modify the verb-cluster contract. `command-clusters`
-  remains the locked source of truth for invocation. This contract is
-  additive.
-- **Does not** ship telemetry. The top-10 is derived from declared
-  profile membership, not observed usage. A usage-based top-10
-  recomputation is deferred to Item 10 (Cost Governance Dashboard),
-  which already collects per-command call counts.
-
-## Open questions (post-beta)
-
-1. **Profile evolution.** When a seventh profile lands (e.g.
-   `researcher`), what is the membership review process for the
-   top-10? Proposal: any new profile triggers a `regen_top10.py` run
-   and a CHANGELOG entry; no manual review unless the top-10 order
-   changes.
-2. **Profile-prefix invocation.** If the no-rename verdict is
-   revisited (e.g. user research shows discoverability still fails
-   even with the README + wizard surfaces), a separate ADR records
-   the decision; this contract does not pre-authorize it.
-3. **Catalog generator.** `docs/catalog.md` is currently
-   handwritten. The `profiles:` line proposed in the discoverability
-   table requires `scripts/regen_catalog.py` to consume profile YAMLs
-   — deferred to its own roadmap step.
-
-## See also
-
-- [`command-clusters`](command-clusters.md) — verb-axis (invocation)
-- [`profile-system`](profile-system.md) — profile-axis (discoverability)
-- [`command-surface-tiers`](command-surface-tiers.md) — tier-axis (`./agent-config --help` visibility)
-- `step-15-product-refinement` § Phase 2 Item 6

package/docs/contracts/condensation-default-kill-criterion.md

@@ -1,116 +0,0 @@
----
-stability: beta
-keep-beta-until: 2026-08-14
----
-
-# Condensation default — kill-criterion
-
-> **Status:** v1-measured · criterion not met · default stays `off` · **Owner:** `step-16-telegraph-substance.md`
-> Phase 1 closeout · **Sources:** [`internal/bench/reports/telegraph-v1.md`](../../bench/reports/telegraph-v1.md) ·
-> [`council-synthesis.md` § 7](../../agents/evidence/audits/2026-05-14-north-star/council-synthesis.md) <!-- council-ref-allowed: ADR decision trace for v1 kill-criterion verdict --> ·
-> [`telegraph-v1-kc-verdict.json`](../../agents/runtime/council/responses/telegraph-v1-kc-verdict.json) <!-- council-ref-allowed: ADR decision trace for v1 kill-criterion verdict -->
-
-## Rule
-
-```
-DEFAULT STAYS OFF UNTIL `task bench -- --telegraph` PRODUCES A POSITIVE vs_terse MEDIAN.
-DECISION OWNED BY THE NEXT BENCH CLOSEOUT, NOT BY THIS DOC.
-```
-
-1. **Current state.** `telegraph.speak_scope` defaults `off`. Carve-outs
-   (security · destructive · multi-step · code blocks · paths · numbered
-   options · Iron-Law markers) are documented in
-   [`telegraph-speak`](../../.agent-src.uncondensed/rules/telegraph-speak.md)
-   but the feature is non-promoted: no skill recommends turning it on,
-   no preset enables it, no profile depends on it.
-2. **Baselines.** Every published `internal/bench/reports/telegraph-v<N>.{json,md}`
-   measures three arms (`condensed` · `terse-control` ·
-   `uncondensed`) and reports two savings columns:
-   - `vs_raw` — median savings against the uncondensed arm.
-   - `vs_terse` — **load-bearing** median savings against the
-     `Answer concisely.` terse-control arm. `vs_raw` is inflated by the
-     carve-out-tax-free pure-prose case and is **not** the gate metric.
-3. **Decision table.** Read the latest `internal/bench/reports/telegraph-v<N>.md`
-   and apply exactly one of:
-
-   | Measured `vs_terse` median | Quality regression on corpus | Verdict |
-   |---|---|---|
-   | < 0 % | any | **Criterion not met — defer.** Keep default `off`. No telemetry multiplier. Next move owned by the corpus-widening / methodology-revision step that produces `telegraph-v<N+1>`. |
-   | 0 % – < 30 % | any | **Hold.** Keep default `off`. Authorised follow-up: widen corpus or tune carve-out share; no default flip. |
-   | ≥ 30 % | < 5 % | **Flip default on** — `telegraph.speak_scope` defaults to a non-`off` value (separate roadmap), carve-outs stay, statusline surfaces lifetime tokens saved. |
-   | ≥ 30 % | ≥ 5 % | **Hold** — repeat the window once with tuned intensity ladder; second hold → deprecate. |
-
-   "Quality regression" = host-side rubric on the corpus per
-   `benchmark-report-schema.md`. Numbers checked into the published
-   `telegraph-v<N>.json` as the decision artefact.
-4. **No interim flip.** The default does not move on anecdote,
-   gut feeling, or a single positive prompt. Only a published
-   `telegraph-v<N>` report with a `vs_terse` median in the "Flip" row
-   above authorises a default change, under a follow-up roadmap.
-
-## v1 verdict (2026-05-16)
-
-[`internal/bench/reports/telegraph-v1.md`](../../bench/reports/telegraph-v1.md)
-landed 30 calls · $0.0805 · 0 errors · `claude-sonnet-4-5`:
-
-| Metric | Median | p10 | p90 |
-|---|---:|---:|---:|
-| `vs_raw` savings | +23.51 % | -18.29 % | +52.53 % |
-| **`vs_terse` savings** | **−9.27 %** | **−109.85 %** | +51.32 % |
-| Realised carve-out share (condensed arm) | 30.67 % | — | — |
-
-Per row 1 of the table, the v1 verdict is **criterion not met — defer**.
-Default stays `off`; no telemetry multiplier ships; no rule retirement
-in this roadmap. Wins exist only on pure-prose prompts (telegraph-09
-+50.5 %, telegraph-10 +58.4 %); carve-out-heavy prompts drag the median
-negative (telegraph-04 path-list −108 %, telegraph-06 mode-marker −123 %).
-
-### Council split (recorded, not decisive)
-
-Council run [`telegraph-v1-kc-verdict.json`](../../agents/runtime/council/responses/telegraph-v1-kc-verdict.json) <!-- council-ref-allowed: ADR decision trace for v1 kill-criterion verdict -->
-(2 members · 1 round · $0.0514 actual) split:
-
-- **`claude-sonnet-4-5`** → Decision A.1 (deprecate now) + Decision B.3
-  (suspend telemetry). Reasoning: the roadmap pinned `vs_terse` as
-  load-bearing; the data falsified it; retreating to `vs_raw` is
-  post-hoc rationalisation.
-- **`gpt-4o`** → Decision A.3 (hold + re-bench with widened corpus +
-  revised terse-control prompt) + Decision B.2 (per-category
-  multipliers, suppress negatives). Reasoning: 10 prompts is a
-  razor-thin sample; the terse-control prompt may under-condense; the
-  carve-out validator (Phase 4) is not yet shipped, so we are
-  measuring a half-implemented feature.
-
-**Synthesis (criterion-not-met + defer).** Both members agreed `vs_terse`
-is the right gate. Neither's strongest path is taken in full inside
-step-16: deprecation is reserved for a follow-up roadmap once v2 confirms
-v1; re-bench is reserved for a follow-up roadmap with the methodology
-revision the council requested. Step-16 ships the infrastructure (corpus,
-bench arm, validator), records the v1 verdict, suspends the telemetry
-multiplier, and hands the deprecate-vs-rebench call to the v2 roadmap.
-
-## Why this is parked, not decided
-
-The 2026-05-14 council split (Opus = remove now, o1 = measure-then-decide)
-predated v1 numbers. The 2026-05-16 council split (Sonnet = deprecate now,
-GPT-4o = re-bench) is informed by v1 but disagrees on which methodological
-weakness is decisive. The kill table above gives every future bench run a
-deterministic resolution path and stops every downstream roadmap from
-re-litigating condensation on every PR.
-
-## Cross-references
-
-- [`internal/bench/reports/telegraph-v1.md`](../../bench/reports/telegraph-v1.md)
-  — v1 measurement; canonical baseline this doc cites.
-- [`docs/benchmarks.md`](../benchmarks.md)
-  — cadence + when the next bench run is mandatory.
-- [`telegraph-telemetry`](telegraph-telemetry.md)
-  — multiplier contract; records the suspended state v2 must lift.
-- [`telegraph-speak`](../../.agent-src.uncondensed/rules/telegraph-speak.md)
-  — runtime rule; reads `telegraph.speak_scope` from settings.
-
-## Done
-
-This doc reflects the v1 verdict. It is **not** an action item. The next
-bench closeout (against `telegraph-v2` once a widened corpus or revised
-methodology is shipped) closes the loop.

package/docs/contracts/config-presets.md

@@ -1,144 +0,0 @@
----
-stability: beta
-keep-beta-until: 2026-08-14
----
-
-# Config Presets — Contract
-
-> **Status:** beta · **Owner:** package maintainer · **Last reviewed:** 2026-05-16
->
-> Schema and semantics for the **Config Preset** axis introduced in
-> step-15 Phase 1 item 4. Records the **Cost Enforcement** model
-> (Council v3 action #3 prerequisite) so the preset loader can ship.
-> Boundary against `profile.id`, `pack.id`, and `rule_loading_tier`:
-> [`ADR-010`](../decisions/ADR-010-profile-pack-preset-boundary.md).
-
-## Decision
-
-A **preset** owns governance knobs that the user wants to tune as a
-bundle, not individually. Three seed presets ship; users can declare
-their own under `.agent-src.uncondensed/presets/<id>.yml`.
-
-| `preset.id` | Stance | Typical user |
-|---|---|---|
-| `fast` | Lowest friction; widest autonomy; loosest cost caps | Solo founder, throw-away prototype, exploration |
-| **`balanced`** *(default)* | Moderate friction; per-task autonomy; sensible cost caps | Day-to-day work; default for any new install |
-| `strict` | Highest friction; ask-by-default; tight cost caps; block-on-risk | Production paths, regulated work, shared trunks |
-
-Profile-aware overlay: `developer + strict` ≠ `founder + strict` — the
-profile selects which knob in the preset is read first (e.g. `developer`
-reads `block_on_risk.code_paths`, `founder` reads `block_on_risk.financial_paths`).
-
-## Preset shape
-
-```yaml
-preset:
-  id: balanced
-  autonomy:
-    default: auto              # on | off | auto (see autonomous-execution rule)
-    trivial_suppress: true
-  confidence:
-    min_band: medium           # low | medium | high — block plan if below
-    require_evidence: false
-  risk:
-    block_on: [security, prod_data]
-    ask_on: [bulk_delete, schema_change]
-  council:
-    auto_consult: false
-    cap_per_consult_usd: 0.50
-  mcp:
-    per_call_max_usd: 0.10
-    per_session_max_usd: 2.00
-  cost:
-    daily_max_usd: 10.00
-    weekly_max_usd: 50.00
-    monthly_max_usd: 150.00
-    enforce: hybrid            # see Cost Enforcement section
-  notifications:
-    threshold_pct: [50, 75, 90, 100]
-```
-
-## Cost Enforcement
-
-*Hybrid model* — recorded as the Phase 1 prerequisite per Council v3
-action #3. Two enforcement surfaces, one decision per call.
-
-### Hard enforcement (preset loader, blocking)
-
-The preset loader **refuses to dispatch** any council or MCP call whose
-*estimated* cost exceeds the active preset's per-call ceiling. The
-estimate is read from the model adapter (`council_cli.py estimate` for
-council; the MCP tool manifest for MCP). The block is raised **before**
-the network call. There is no override flag — the user must change the
-preset, override `cost.per_call_max_usd` in `.agent-settings.yml`, or
-pass `--preset=fast` on the CLI.
-
-```
-PRE-CALL CEILING IS HARD.
-NO RUNTIME OVERRIDE. NO "JUST THIS ONCE" FLAG.
-EXCEED → REFUSE → SURFACE THE CEILING + THE OVERRIDE PATH.
-```
-
-Applies to:
-
-- AI Council consults (`scripts/council_cli.py run`).
-- MCP tool calls dispatched through the universal dispatcher
-  ([`hook-architecture-v1`](hook-architecture-v1.md)).
-- Any future skill that reads `preset.cost.per_call_max_usd`.
-
-### Advisory dashboard (retroactive, non-blocking)
-
-`agent-config cost` (Phase 2 item 10) surfaces daily / weekly / monthly
-spend against the active preset's caps. The dashboard **does not**
-block — it warns at the thresholds in `preset.notifications.threshold_pct`
-(default `50 / 75 / 90 / 100`). At 100 %, the dashboard prints a hard
-warning; the next session start re-checks the cap against the running
-total before dispatching the next paid call.
-
-The advisory layer's role is **awareness**, not enforcement. Enforcement
-is exclusively the per-call ceiling above; retroactive blocking would
-turn a session unrecoverably hostile mid-task.
-
-### What the loader does **not** do
-
-- It does **not** estimate cost for unpaid local model calls
-  (`ollama`, local llama.cpp). These bypass both surfaces.
-- It does **not** estimate cost for non-LLM tool calls (file reads,
-  shell commands, MCP-static-resource fetches). The per-call ceiling
-  targets paid token spend.
-- It does **not** override the Hard Floor in
-  [`non-destructive-by-default`](../../dist/agent-src/rules/non-destructive-by-default.md)
-  — a preset cannot lift the universal safety floor.
-
-## Resolution chain
-
-Reads happen in this order; last writer wins for any single knob:
-
-1. `pack.preset_id` (if pack active) → set `preset.id`.
-2. `profile.preset_id` → set `preset.id` (if not already set by pack).
-3. `preset.<id>.yml` → fill all knobs.
-4. `.agent-settings.yml` user keys under `preset:` → override per-knob.
-5. Environment variables (`AGENT_CONFIG_PRESET_COST_DAILY_MAX_USD=…`)
-   → override per-knob.
-6. Runtime CLI flags (`--preset-cost-per-call-max-usd=…`) → override
-   per-knob, single session.
-
-Per [`ADR-010`](../decisions/ADR-010-profile-pack-preset-boundary.md),
-no other axis may write preset-owned knobs.
-
-## Drift detection
-
-`task lint-config-schema` (added in Phase 1) hard-fails when:
-
-- A pack YAML or profile YAML names a preset-owned knob.
-- A preset YAML names a knob outside this contract.
-- The three seed presets diverge from the documented stances above.
-
-## Non-goals
-
-- This contract does **not** define profiles, packs, or `rule_loading_tier`.
-  See the corresponding contracts.
-- It does **not** ship a UI. CLI-first (`agent-config cost`,
-  `agent-config preset set <id>`).
-- It does **not** auto-migrate existing installs. Without a preset,
-  the loader falls back to current per-knob defaults (`balanced`-equivalent).

package/docs/contracts/conformance.md

@@ -1,84 +0,0 @@
----
-stability: beta
-keep-beta-until: 2026-10-01
----
-
-# Conformance contract — green means installed AND firing
-
-> **Status:** active · **Owner:** maintainer · **Siblings:**
-> [`install-layout.md`](install-layout.md) · [`smoke-contracts.md`](smoke-contracts.md)
-
-`task conformance` (equivalently `agent-config conformance`) is the
-consumer-runnable, CI-shaped answer to one question:
-
-> **Is agent-config installed *and firing* in this repo?**
-
-It is deterministic — no LLM, no network — and safe to wire into a
-consumer repo's CI. A green run is the "conformance badge" a repo earns;
-a red run names the exact broken surface and its remedy.
-
-## § 1 — What runs
-
-Two legs, one exit code:
-
-1. **Doctor under the `--ci` contract.** `agent-config doctor --ci` runs
-   the full drift scan plus every registered health check, emits a JSON
-   payload, and — unlike the default doctor run, which keys its exit off
-   drift only — folds **any check failure** into the exit code.
-2. **Five conformance checks** (registered in
-   `src/scripts/_cli/cmd_conformance.ts`):
-
-| id | proves | red when |
-|---|---|---|
-| `txlog-clean` | the last install completed | the install-log tail is an abandoned `abort` |
-| `router-pointers` | the installed rule index is intact | any rule id or `routes_to` target does not resolve on disk |
-| `hook-dispatcher` | hooks actually fire on this host | the dispatcher errors on a synthetic `session_start` / `stop` envelope |
-| `lean-projection` | `lean_projection.mode` matches reality | projected non-kernel rules contradict the configured mode |
-| `host-manifest` | `subagents.host_capabilities` is well-formed | unknown keys / non-boolean values (typo guard) |
-
-Every check returns `ok` / `warn` / `fail` / `skipped` with a one-line
-remedy. `skipped` means "not applicable here", never "silently passed".
-
-## § 2 — Exit-code contract
-
-| Exit | Meaning |
-|---|---|
-| `0` | Green — no check failed, no drift. Warnings allowed. |
-| `1` | Red — at least one check failed, or manifest drift present. |
-| `2` | Environment unresolvable (no project root, corrupt setup). |
-
-The same contract applies to `agent-config doctor --ci` standalone.
-
-## § 3 — Report line (fleet aggregation)
-
-Every run appends exactly one JSONL line — mirroring the install-txlog
-entry shape — to `~/.event4u/agent-config/conformance-log.jsonl`
-(override: `AGENT_CONFIG_CONFORMANCE_LOG`):
-
-```json
-{"ts":"2026-07-07T10:00:00.000Z","kind":"conformance","path":"/repo","sha256":null,"note":"5/5 ok; fails: none"}
-```
-
-Fleet installs (`--fleet`) aggregate these lines into their per-repo
-summary; the line is append-only and never breaks the exit contract.
-
-## § 4 — Pre-install twin: `init --validate-only`
-
-`agent-config init --validate-only` is the **pre-install** gate — the
-typed pre-flight suite (`src/install/preflight.ts`): target-root
-permissions, free-disk floor, conflict detection, host-detection
-sanity. Nothing is written. Exit `0` = clear, `1` = blocking finding,
-`2` = no runner. `--dry-run` (full plan print) and `--minimal`
-(settings-only bootstrap) are the existing siblings; `--validate-only`
-completes the trio.
-
-## § 5 — CI wiring (consumer)
-
-```yaml
-- name: agent-config conformance
-  run: npx @event4u/agent-config conformance
-```
-
-Green conformance in a consumer pipeline is the supported way to assert
-"the OS is installed and firing here" — instead of hand-rolled greps
-over projected files.