@event4u/agent-config 9.7.0 → 9.9.0

package/docs/decisions/ADR-123-runtime-security-scope-and-spawn-hardening.md

@@ -1,142 +0,0 @@
----
-adr: 123
-status: accepted
-date: 2026-07-20
-decision: runtime-security-scope-and-spawn-hardening
-supersedes: —
-superseded_by: —
-phase: road-to-runtime-security-hardening
-type: structural
----
-
-# ADR-123 — Runtime-security scope: harden subprocess spawn-env, keep behavioural enforcement out of scope
-
-- **Status:** Accepted (2026-07-20)
-- **Closes:** `agents/roadmaps/archive/road-to-runtime-security-hardening.md`
-- **Related:** `docs/threat-model.md` row (d) (lethal-trifecta); `src/rules/tool-safety.md` (Least Agency); `src/rules/lethal-trifecta-guard.md`; `src/rules/untrusted-input-defense.md`.
-
-## Context
-
-A user-supplied source-level analysis compared agent-config's security stack
-against an external reference plugin (referred to only as **Source A** per
-`source-confidentiality`; © the third party, all-rights-reserved — concept
-adoption only, no code/regex/prompt port). It surfaced two distinct things that
-were repeatedly conflated:
-
-1. **A real shipped bug.** `src/scripts/ai_council/clients.ts::_runSubprocess`
-   built its `spawnSync` options with no `env:` key, so every spawned provider
-   CLI (`codex` / `claude` / `gemini`) — and any `git` those CLIs invoke
-   internally — inherited the full parent `process.env`. An attacker-influenced
-   `GIT_EXTERNAL_DIFF` / `core.pager` / `NODE_OPTIONS` / `LD_PRELOAD` /
-   `DYLD_INSERT_LIBRARIES` in the parent environment is remote code execution
-   (CWE-426 untrusted search path, CWE-88 argument injection). This is our own
-   transport violating the Least-Agency its `tool-safety` rule preaches.
-
-2. **A proposed scope reversal.** The analysis argued that because
-   `injection_scan_hook.ts` already scans **inbound** tool responses, the
-   threat-model's "runtime enforcement out of scope" decision (row (d)) is
-   already void, so we should also scan **outbound** — the content the agent
-   writes — with a pattern guard, a turn-diff baseline, and eventually an LLM
-   diff-review.
-
-A two-round council (2026-07-20, anthropic/claude-sonnet-4-5 + openai/gpt-4o)
-was decisive: round 1 leaned toward building the outbound guard; **round 2 both
-members pivoted skeptical** on the load-bearing distinction below.
-
-## Decision
-
-**1. Fix the spawn-env RCE (accepted, shipped in this roadmap).** A shared
-`src/scripts/_lib/spawn_env.ts::hardenedSpawnEnv(overrides?)` scrubs the
-code-execution-injection env families **by family, not by allowlist** — the
-provider CLIs legitimately need arbitrary env (API keys, config paths), so an
-allowlist would break them and rot; deny-by-family removes the known vectors
-(dynamic-loader `LD_*`/`DYLD_*`/`GCONV_PATH`, git `*_COMMAND`/`GIT_EXTERNAL_DIFF`/
-`GIT_SSH_COMMAND`/`PAGER`, runtime hooks `NODE_OPTIONS`/`BASH_ENV`/`ENV`/
-`PYTHON*`/`PERL5*`/`RUBYOPT`, and `IFS`) and preserves everything else. It is
-wired into the council transport and the two consumer-runtime hook spawn sites
-(`roadmap_progress_hook`, `hot_context_hook`), and guarded by a falsifiable
-regression test (proven RED without the fix — 8 vectors leaked into the child —
-GREEN with it).
-
-**2. Input sanitization ≠ runtime behavioural enforcement — row (d) stands.**
-The inbound `injection_scan_hook` is **self-defence**: it hardens AC's own
-handling of data it *receives* from external tools. It does **not** commit AC to
-*governing what the agent writes*. An outbound command guard requires
-interpreting intent from content (`rm -rf ./build` vs `rm -rf /`) — that is a
-runtime **enforcement** layer, a categorically different mechanism, and the one
-threat-model row (d) places out of scope. AC ships the *rules*
-(`lethal-trifecta-guard`, `untrusted-input-defense`, `tool-safety`); the
-consumer's tool-execution layer is the enforcement boundary. The inbound/outbound
-"asymmetry" is a defensible separation of concerns, not security theatre.
-
-**3. The outbound guard / turn-diff baseline / LLM diff-review are deferred, not
-rejected.** They remain `## Blockers` on the roadmap with a `revisit-if`: a real
-outbound-injection incident, a consumer demand signal, or utilization evidence —
-at which point they must also pass the six-question complexity budget
-(`artifact-drafting-protocol-mechanics` § Complexity budget), given PR #983 just
-consolidated surface and `surface-consolidation-restraint` freezes new modes
-pending the first external adopter. This ADR records the deferral so the
-decision is surfaced, not silently dropped (`decision-revisit-gate`).
-
-**4. Rejected:** a consumer-supplied-pattern ReDoS/trust-framing layer (Source A
-P5) — `security_lint.ts` has no consumer-pattern surface, so guarding it would
-build a defence for a feature that does not exist. Global env/pattern allowlists
-are also rejected: per-file pragma containment (`security_lint.ts`) only.
-
-## Consequences
-
-- The council transport and consumer-runtime hooks can no longer be turned into
-  an RCE vector by a poisoned parent environment; the fix is falsifiably tested.
-- `docs/threat-model.md` gains a row for the (now-mitigated)
-  subprocess-env-inheritance vector, and row (d)'s "no additional mitigation
-  planned" cell cites this ADR for the input-sanitization-vs-enforcement
-  distinction and the deferred-guard decision.
-- AC's security posture stays **authoring-time rules + input hygiene + our own
-  Least-Agency spawn discipline** — it does not become a runtime sandbox
-  supervising every agent tool call.
-- Maintainer-only CI/git-helper spawn sites (~15) are a deferred mechanical
-  sweep (`maintainer-ci-spawn-sweep` blocker): they run in trusted CI with lower
-  attacker-control of the environment.
-
-## Alternatives considered
-
-- **Complete the runtime layer (build the outbound guard now).** Council round 1
-  position. Rejected in round 2: conflates input sanitization with behavioural
-  enforcement; adds net-new enforcement surface with a false-positive burden,
-  right after a consolidation roadmap, with no demand signal.
-- **Delete `injection_scan_hook.ts` for symmetry.** Architecturally consistent
-  but operationally worse — inbound sanitization is legitimate self-defence and
-  costs nothing to keep.
-- **Env allowlist instead of deny-by-family.** Rejected — would strip env the
-  provider CLIs need and rot as new good vars appear.
-
-## Follow-up (2026-07-21) — `road-to-spawn-env-completion`
-
-The 9.6.0 external review reproduced a working exploit against the fix this ADR
-shipped: `GIT_CONFIG_COUNT` / `GIT_CONFIG_KEY_<n>` / `GIT_CONFIG_VALUE_<n>` (and
-`GIT_CONFIG_GLOBAL` / `_SYSTEM`) survived the deny-by-family scrub — the
-`GIT_*_COMMAND` family missed them (no `_COMMAND` suffix) — letting an attacker
-set arbitrary git config (`core.fsmonitor` runs shell on every `git status`,
-which the consumer-runtime hooks trigger). `GIT_ALTERNATE_OBJECT_DIRECTORIES`
-and `HOSTALIASES` also leaked. **Confirmed empirically (all 5) and closed:**
-`hardenedSpawnEnv` now denies the whole `GIT_CONFIG`/`GIT_CONFIG_*` family by
-prefix plus the two exact vars, with falsifiable test vectors (red without the
-fix, green with it).
-
-**`maintainer-ci-spawn-sweep` blocker — resolved by classification, not mass
-migration.** Rather than migrate ~15 low-risk maintainer/CI sites, all spawn
-sites are now classified in `docs/spawn-site-policy.md` (Consumer Runtime /
-Maintainer CLI / trusted CI / install-time). The consumer-runtime dispatcher
-(`hooks/dispatch_hook.ts`) — missed in PR #984 — now routes through
-`hardenedSpawnEnv`; the maintainer/CI/install sites are documented exempt with
-rationale (env is maintainer- or workflow-controlled, not attacker-influenced).
-
-**Secure-spawn lint — rejected (council 2026-07-21, claude-sonnet-4-5 +
-gpt-4o).** A CI lint forbidding raw spawn in runtime paths was proposed (P0 in
-the review) but rejected: it is net-new governance surface (a CI gate +
-allowlist + exemption-adjudication + false-positive triage), which the folded
-complexity-budget lock (PR #983) forbids — the lock text explicitly lists
-"linter". The "retires ad-hoc review" justification failed the retirement test
-(no such review gate exists to retire). `docs/spawn-site-policy.md` is the
-self-enforcing substitute: its completeness claim is checked by git-diff
-visibility at review time, not a build gate.

package/docs/decisions/ADR-200-python-to-typescript-migration.md

@@ -1,203 +0,0 @@
----
-adr: 200
-status: accepted
-date: 2026-06-11
-decision: python-to-typescript-migration
-supersedes: —
-superseded_by: —
-phase: py2ts · migration-infrastructure (historical record — migration landed on main)
-type: structural
----
-
-# ADR-200 — Full Python → TypeScript migration: execution model, branch strategy, dispatcher, parity gates
-
-> **Number retained by decision (2026-07-12):** the provisional-number
-> clause ("final number assigned at the python2ts → main merge") has
-> fired — the migration is complete on `main` (0 tracked `.py` under
-> `src/`). Renumbering was evaluated and declined: 521 files reference
-> "ADR-200" as a stable identifier; a rename would be a 521-file
-> mechanical churn (projections, condensation hashes, docs) for zero
-> behavioral gain. ADR-200 stays the permanent number; the record is
-> historical (migration architecture, landed).
-
-
-> Provisional number 200 (reserved, out-of-band). main ADRs grow sequentially; the migration ADR is renumbered to a high reserved slot to stop recurring collisions on the long-lived `python2ts` branch. Final number is assigned at the `python2ts`→`main` merge.
-
-## Status
-
-**Accepted** · 2026-06-11. Records the locked design of the TypeScript-only
-scripts roadmap (Phase 1, Step 1). Driven by the AI-council convergence of
-2026-06-11 (claude-sonnet-4-5 + gpt-4o, design mode, deep): both members
-converged on migration infrastructure before any porting, the installer as
-consumer trust boundary, pytest→vitest 1:1 ports plus golden replay as the
-parity contract, sequential gated phasing instead of a parallel-agent control
-plane, same-PR deletion of each Python original, and a documented
-intentional-divergence process.
-
-## Context
-
-The package is a hybrid Python + TypeScript system. The Python side spans
-~952 source `.py` files (~204k LOC): `src/scripts/` 419 files (linters/checks
-~17.4k LOC incl. `skill_linter.py` 3.7k, condense/sync pipeline ~3.8k incl.
-the comment-preserving `sync_yaml_rt.py`, ai_council ~17k, hooks ~2.6k,
-memory/telemetry, `install.py` 5.1k, `_lib/` ~6.2k, misc ~44.5k), `tests/`
-413 files (pytest), and `src/agent-src/templates/scripts/` ~100
-consumer-shipped files. The call surface is wide: 60+ `python3` invocations in
-`taskfiles/*.yml`, 40+ in `.github/workflows/*.yml`, 3 in `package.json`,
-15+ doc references in `src/rules` + `src/skills`, and git hooks via
-`hooks/hooks.json`.
-
-The target is a single-language TypeScript codebase: zero tracked `.py` in
-source, no `pyproject.toml`, no `.venv`, no `python3` runtime requirement —
-while every quality gate (linter finding counts, CI green floor, golden
-behavior, consumer-facing CLI contracts) stays provably at or above today's
-level. TS infrastructure already exists (`src/cli/`, `src/server/`,
-`src/shared/`, `src/install/`, strict ES2022 tsconfig, vitest, Node >= 20.11,
-typescript 5.9 + tsx 4.22).
-
-The risk profile is asymmetric: internal lint tooling can tolerate iteration,
-but the installer, git hooks, and consumer-shipped template scripts are trust
-boundaries where a silent behavior change ships to consumers. That asymmetry
-drives every decision below.
-
-## Decision
-
-### 1. Scope — full migration
-
-Migrate all ~952 Python source files to TypeScript. The phased inventory and
-sequencing live in the TypeScript-only scripts roadmap (prerequisites
-section); this ADR locks the architecture, not the schedule. Bench fixture
-clones under `internal/bench/` are test data, not source — out of scope.
-
-### 2. Execution model — sequential gated phasing, subagent fan-out within a phase
-
-- **Across phases: sequential and gated.** A phase starts only when the
-  previous phase's exit criteria are green on the integration branch. No
-  separate control plane — state tracking is the roadmap checkbox layer plus
-  the migration dashboard.
-- **Within a phase: parallel subagent fan-out.** An orchestrator session
-  splits the phase's cluster into dependency-free batches of ~5–15 scripts
-  and dispatches them to parallel porting subagents. Each subagent works in
-  an isolated git worktree on a `feat/py2ts-<phase>-<batch>` branch; each
-  batch lands as one PR.
-- **Verification is independent of porting.** A verification subagent re-runs
-  the parity harness on each batch before the PR is marked ready — the porter
-  never green-lights its own parity claim.
-- **Merge order is foundation-first** within a phase (libs before
-  dependents). Subagents produce ready PRs; they do not merge.
-
-### 3. Branch strategy — `python2ts` integration branch
-
-- A long-lived integration branch **`python2ts`** is cut from `main` in
-  Phase 1 and lives until the migration completes.
-- **Every migration PR targets `python2ts`, never `main`.** A guard check
-  fails any `py2ts`-prefixed PR whose base is not `python2ts`.
-- A **scheduled `main → python2ts` sync** merges mainline changes into the
-  integration branch continuously, so the migration absorbs drift instead of
-  diverging toward a big-bang conflict. `main` stays the consumer-facing
-  trunk and keeps receiving normal work.
-- The **final `python2ts → main` merge is a user-owned delivery decision**
-  outside the roadmap (Hard Floor: production-trunk merge requires explicit
-  per-turn confirmation).
-
-### 4. Dispatcher design — `src/scripts/run.ts`
-
-A dispatch wrapper resolves a script path without extension: prefer
-`<path>.ts` (via tsx in dev, compiled in CI) and fall back to `<path>.py`
-(via `python3`), passing argv, stdin, stdout/stderr, and the exit code
-through unchanged. Consequences:
-
-- **All call sites switch once** (taskfiles, workflows, package.json, hooks,
-  doc references) — before any script is ported.
-- **Per-script migration = add the `.ts` + delete the `.py` in the same
-  PR.** The dispatcher resolves the new `.ts` automatically.
-- **Rollback = `git revert` of the porting PR.** The dispatcher then
-  resolves the restored `.py` again — no call-site churn in either
-  direction.
-
-### 5. Parity strategy — four stacked gates
-
-1. **pytest→vitest 1:1 ports are the behavioral specification.** Mechanical
-   translation only (`parametrize` → `test.each`, `monkeypatch` → `vi.mock`,
-   fixtures → `beforeEach`) — never "redefine test intent".
-2. **Golden replay.** Execute the Python and TS versions on identical
-   fixtures; compare stdout/stderr/exit code/written files byte-exact, with
-   an opt-in JSON/YAML normalization layer.
-3. **Coverage-diff gate.** `vitest --coverage` must be ≥ the `pytest --cov`
-   baseline per ported cluster, on both line and branch coverage.
-4. **Error parity for consumer-facing scripts.** A fixture corpus of failure
-   scenarios (bad input, missing file, invalid flags) comparing error text,
-   output channel, and exit code.
-
-Python style (snake_case CLI flags, exit codes, stdout/stderr split) is part
-of the contract — TS ports keep them identical unless a documented divergence
-says otherwise.
-
-### 6. Intentional-divergence process
-
-Every golden-parity mismatch requires a divergence doc in
-`docs/migration/divergences/` (symptom, root cause, bug-fix-vs-regression
-verdict, evidence, approval) before the porting PR can pass CI. The quality
-floor reads: **quality must not degrade; documented improvements are allowed
-and explicitly approved.** An undocumented difference is a regression by
-definition. See `docs/migration/divergences/README.md` for the process.
-
-### 7. Runtime model
-
-- **Internal tooling runs via tsx** (no precompile; acceptable startup for
-  lint/CI tasks).
-- **Consumer-shipped templates and git-hook entry points ship as compiled
-  esbuild single-file bundles** — consumers need Node only (no tsx, no
-  node_modules resolution inside consumer projects), and hooks keep their
-  cold-start budget and exit-0 guarantee.
-
-## Consequences
-
-- Phase 1 (dispatcher, parity harness, YAML round-trip spike, branch +
-  sync + drift infrastructure, divergence process, phase-gate CI) is a hard
-  blocker — nothing ports before it is green.
-- The same-PR deletion rule prevents a drifting dual-source window per
-  script; the cost is that each porting PR must clear all four parity gates
-  before merge.
-- Later-phase Python scripts must not import half-migrated libs across
-  languages; Python `_lib` files needed by an unported importer stay in
-  place until that importer's own phase deletes them.
-- The `python2ts` branch carries the full migration risk away from `main`;
-  consumers see no change until the user-owned final merge.
-- Business-logic refactors are forbidden while porting (minimal safe diff
-  per script): port first, improve via documented divergence or follow-up.
-
-## Alternatives considered
-
-- **Parallel-agent control plane** (a coordinator service tracking migration
-  state outside the repo) — rejected: the roadmap checkbox layer plus a
-  dashboard script gives the same visibility with zero extra infrastructure,
-  and sequential phase gates remove the coordination problem the control
-  plane would solve.
-- **Migration PRs against `main`** — rejected: every porting PR would put
-  consumer-facing trunk at risk and force the full migration gate set onto
-  unrelated mainline work; the integration branch isolates both directions.
-- **Big-bang cutover** (port everything on a branch, switch call sites at
-  the end) — rejected: the dispatcher makes incremental per-script cutover
-  free, with `git revert` rollback per script instead of an all-or-nothing
-  merge.
-- **Keeping Python originals alongside TS ports** ("soak window") — rejected:
-  a dual-source window invites silent drift; git history is the soak window,
-  and the dispatcher's `.py` fallback makes a revert behave identically.
-- **Rewriting tests idiomatically during the port** — rejected: the pytest
-  suite is the behavioral spec; redefining intent while porting destroys the
-  only oracle the migration has.
-
-## References
-
-- The TypeScript-only scripts roadmap (full phase plan, inventory, exit
-  criteria) — referenced by name; roadmaps are a transient layer and are not
-  linked from stable artifacts.
-- AI-council convergence 2026-06-11 (claude-sonnet-4-5 + gpt-4o, design
-  mode, deep) — inline summary above; council artifacts are local-only.
-- `docs/migration/divergences/README.md` — divergence process.
-- `docs/migration/divergences/_template.md` — divergence doc template.
-- [ADR-012](ADR-012-typescript-cli-shell.md) — TypeScript CLI shell (the
-  existing TS infrastructure this migration extends).
-- [ADR-087](ADR-087-installer-e2e-test-strategy.md) — installer container
-  e2e (the golden corpus base for the dual-mode installer phase).

package/docs/decisions/ADR-rule-kernel-and-router.md

@@ -1,133 +0,0 @@
----
-adr: —
-status: accepted
-date: 2026-05-06
-decision: rule-kernel-and-router-roadmap-closure
-supersedes: —
-superseded_by: —
-phase: road-to-kernel-and-router (closure record)
-type: structural
----
-
-# ADR — Rule Kernel and Router (Roadmap Closure)
-
-- **Status:** Accepted (2026-05-06)
-- **Closes:** `agents/roadmaps/road-to-kernel-and-router.md`
-- **Sibling roadmaps closed in the same window:**
-  `agents/roadmaps/road-to-token-optimization.md`
-  (Phase 1 shipped, Phase 2/3 deferred-with-trigger by design),
-  `agents/roadmaps/road-to-package-optimization.md`
-  (closed with null result per P1.1 binary acceptance gate).
-- **Related ADRs:** ADR-001 (kernel-swap deferred), ADR-002
-  (kernel-bucket cap raise 25k → 26k, per-rule Iron-Law overrides).
-
-## Context
-
-The agent rule set was an "always-loaded" surface: every conversation
-paid the full 193k-char rule cost regardless of task. There was no
-deterministic way to load only the policy actually relevant to the
-current intent, and no mechanical guard against rule-bucket creep.
-
-## Decision
-
-Adopt a **Kernel + Router** loading model with three tiers and three
-cost profiles, governed by a compiled router manifest and CI-enforced
-size budgets.
-
-### What shipped
-
-- **Kernel:** 9 always-loaded Iron-Law rules (`agent-authority`,
-  `ask-when-uncertain`, `commit-policy`, `direct-answers`,
-  `language-and-tone`, `no-cheap-questions`,
-  `non-destructive-by-default`, `scope-control`,
-  `verify-before-complete`). Locked set:
-  [`docs/contracts/kernel-membership.md`](../contracts/kernel-membership.md).
-- **Router:** `router.json` compiled deterministically from rule
-  frontmatter (`tier:`, `triggers:`, `routes_to:`) by
-  `scripts/compile_router.py`. Contract:
-  [`docs/contracts/rule-router.md`](../contracts/rule-router.md).
-- **Cost profiles:** `minimal` = kernel only · `balanced` = kernel +
-  tier-1 (default) · `full` = kernel + tier-1 + tier-2.
-- **Budget gates:** `task lint-rule-budget` enforces kernel ≤ 26k chars
-  and per-rule ≤ 2.5k (Iron-Law overrides up to 4.0k via ADR-002).
-  Daily snapshots in `agents/runtime/.rule-budget-history.jsonl`.
-- **Condensation discipline:** P4.3 brought the auto-bucket from
-  ~75k → 59 220 chars (under the 60k target) without behaviour drift.
-
-### What we cut
-
-- **P4.1 / P4.2** — auto-rule → skill / guideline migrations.
-  Cancelled as scope-cut after P4.3 condensation alone landed the
-  auto-bucket under target. The migrations were a means, not an end.
-- **road-to-package-optimization Phase 1.2 / 1.3 / Phase 2 / Phase 3**
-  — cancelled per P1.1's binary acceptance gate. The prototype
-  contradiction linter scanned 317 artefacts in 0.034 s and flagged
-  zero cross-artefact contradictions. The artefact surface is
-  empirically already well-governed on the heuristics tested; building
-  a production linter for a non-existent failure mode is not honest.
-- **road-to-token-optimization Phase 2 / Phase 3** — *not* cut, just
-  trigger-deferred by design (telemetry threshold + `/cost:report`
-  ship). Will reopen autonomously when their declared signals fire.
-
-### What stayed
-
-- All Iron-Law fences. SHA-verified preserved by
-  `scripts/iron_law_sha.py` across the kernel condensation pass.
-- Behaviour parity. Golden transcripts pass under all three profiles.
-- The pre-existing `auto`-tier rules; only their condensed bodies
-  changed, never their obligation surface.
-
-## Profile semantics
-
-| Profile | Buckets loaded | Use case |
-|---|---|---|
-| `minimal` | kernel only | Tightly bounded automation, CLI shell-outs, "run this one command" |
-| `balanced` *(default)* | kernel + tier-1 | Day-to-day engineering work; matches pre-roadmap behaviour superset |
-| `full` | kernel + tier-1 + tier-2 | Architectural / cross-wing / governance sessions |
-
-Consumer projects opt in via `personal.rule_loading_tier` in
-`.agent-settings.yml`. The install script keeps user-set values; only
-the template default is `balanced`.
-
-## Reversibility
-
-If the Kernel + Router model needs unwinding:
-
-1. Set every rule's frontmatter `tier:` to `kernel` and rebuild
-   `router.json` — every rule loads on every turn (legacy behaviour).
-2. Drop `lint-rule-budget` from `task ci`.
-3. The compiled `router.json` is a derived artefact; deleting it and
-   running `compile_router.py --no-router` returns the always-loaded
-   model.
-
-No data migration, no irreversible condensation. Iron-Law SHA fences
-mean Iron Laws can be diffed against the pre-roadmap baseline at any
-point.
-
-## Final measurements (2026-05-06)
-
-| Metric | Pre-roadmap | Post-roadmap | Δ |
-|---|---:|---:|---:|
-| kernel bucket | n/a (always-loaded) | 25 590 | new gate |
-| auto bucket | ~75 000 | 59 220 | −21 % |
-| total rule chars | ~193 000 | 84 810 | −56 % |
-| rule count | 56 | 57 (added `token-optimizer-maintenance`) | +1 |
-| skills count | 134 | 135 (added `token-optimizer`) | +1 |
-
-Kernel-bucket-check: PASS. Per-rule cap: 16 rules over 2.5k target,
-all within 4.0k Iron-Law override per ADR-002. Trend snapshot
-appended to `agents/runtime/.rule-budget-history.jsonl`.
-
-## Consequences
-
-- New rule submissions must declare `tier:` + `triggers:` + (when
-  applicable) `routes_to:` in frontmatter; the router compiler
-  rejects malformed entries.
-- Editing Iron-Law-fenced bodies requires a fresh
-  `scripts/iron_law_sha.py --update` pass; CI fails on hash drift.
-- The `token-optimizer` skill is now the single consult surface for
-  token-cost decisions; editing any cited asset requires a same-commit
-  catalog update per `token-optimizer-maintenance` rule (CI-backstopped
-  by `scripts/check_token_optimizer_freshness.py`).
-- Deferred phases (token-opt P2/P3, kernel-swap from ADR-001) remain
-  reopenable on their declared triggers without further roadmap work.

package/docs/decisions/INDEX.md

@@ -1,136 +0,0 @@
-# ADR Index
-
-_Auto-generated by `scripts/adr/regenerate_index.py`. Do not edit._
-
-| # | Title | Status | Date | Supersedes |
-|---|---|---|---|---|
-| [ADR-001](ADR-001-kernel-swap-deferred.md) | Kernel Swap Deferred | accepted | 2026-05-06 | — |
-| [ADR-002](ADR-002-kernel-bucket-overrides.md) | Kernel Bucket Overrides | accepted | 2026-05-06 | — |
-| [ADR-003](ADR-003-flat-cluster-subs-and-colon-syntax.md) | Flat Cluster Subs And Colon Syntax | accepted | 2026-05-07 | — |
-| [ADR-004](ADR-004-rule-governance-pruning.md) | Rule Governance Pruning | accepted | 2026-05-08 | — |
-| [ADR-005](ADR-005-subagent-worktrees.md) | Subagent Worktrees No Auto Merge | accepted | 2026-05-09 | — |
-| [ADR-006](ADR-006-skill-tools-python-pilot.md) | Skill Tools Python Pilot Pass | accepted | 2026-05-09 | — |
-| [ADR-007](ADR-007-agent-discovery-scopes.md) | Global Default Install With Export Subcommand | accepted | 2026-05-12 | — |
-| [ADR-008](ADR-008-installed-tools-manifest.md) | Committed Installed Tools Manifest Separate From Settings | proposed | 2026-05-12 | — |
-| [ADR-009](ADR-009-event4u-namespace.md) | Event4U Namespace And Claude Desktop Zip Bundles | accepted | 2026-05-13 | — |
-| [ADR-010](ADR-010-profile-pack-preset-boundary.md) | Profile Pack Preset Boundary | proposed | 2026-05-16 | — |
-| [ADR-011](ADR-011-domain-pack-readiness.md) | Domain Pack Readiness | accepted | 2026-05-17 | — |
-| [ADR-012](ADR-012-typescript-cli-shell.md) | Typescript Cli Shell | accepted | 2026-05-19 | — |
-| [ADR-013](ADR-013-discovery-frontmatter-contract.md) | Discovery Frontmatter Contract | accepted | 2026-05-19 | — |
-| [ADR-014](ADR-014-gui-framework-choice.md) | Gui Framework Choice | accepted | 2026-05-20 | — |
-| [ADR-015](ADR-015-discovery-manifest-contract.md) | Discovery Manifest Contract | accepted | 2026-05-21 | — |
-| [ADR-016](ADR-016-installer-architecture.md) | Installer Architecture | accepted | 2026-05-21 | — |
-| [ADR-017](ADR-017-monorepo-physical-layout.md) | Monorepo Physical Layout | accepted | 2026-05-21 | — |
-| [ADR-018](ADR-018-trust-and-safety-layer.md) | Trust And Safety Layer | accepted | 2026-05-21 | — |
-| [ADR-019](ADR-019-router-json-dist-location.md) | Router Json Dist Location | accepted | 2026-05-23 | — |
-| [ADR-020](ADR-020-global-only-consumer-scope.md) | Global Only Consumer Scope | accepted | 2026-05-23 | — |
-| [ADR-021](ADR-021-deployment-shape.md) | Deployment Shape | accepted | 2026-05-24 | — |
-| [ADR-022](ADR-022-daily-workspace-decomposition.md) | Daily Workspace Decomposition | accepted | 2026-05-24 | — |
-| [ADR-023](ADR-023-host-agent-protocol.md) | Host Agent Protocol | accepted | 2026-05-24 | — |
-| [ADR-024](ADR-024-workspace-v0-feature-floor.md) | Workspace V0 Feature Floor | accepted | 2026-05-24 | — |
-| [ADR-025](ADR-025-workspace-chrome.md) | Workspace Chrome | accepted | 2026-05-24 | — |
-| [ADR-026](ADR-026-explain-mode-translation.md) | Explain Mode Translation | accepted | 2026-05-24 | — |
-| [ADR-027](ADR-027-changelog-machine-vs-manual.md) | Changelog Machine Vs Manual | accepted | 2026-05-25 | — |
-| [ADR-028](ADR-028-root-layout.md) | Root Layout | superseded | 2026-05-25 | — |
-| [ADR-029](ADR-029-multi-workspace-deferred.md) | Multi Workspace Deferred | accepted | 2026-05-25 | — |
-| [ADR-030](ADR-030-claude-code-command-projection.md) | Claude Code Command Projection | accepted | 2026-05-28 | — |
-| [ADR-031](ADR-031-validation-severity-tiers-and-projection-roundtrip.md) | Validation Severity Tiers And Projection Roundtrip | accepted | 2026-05-29 | — |
-| [ADR-032](ADR-032-linked-projects-scope.md) | Linked Projects Scope Go Option A | accepted | 2026-05-29 | — |
-| [ADR-033](ADR-033-distribution-identity-npm-primary.md) | Distribution Identity Npm Primary | accepted | 2026-05-29 | — |
-| [ADR-034](ADR-034-per-skill-model-recommendation-transport.md) | Per Skill Model Recommendation Transport | superseded | 2026-05-30 | — |
-| [ADR-035](ADR-035-model-capability-tiers.md) | Model Capability Tiers | accepted | 2026-05-30 | 034 |
-| [ADR-036](ADR-036-global-install-browser-wizard-handoff.md) | Global Install Browser Wizard Handoff | accepted | 2026-06-01 | — |
-| [ADR-037](ADR-037-cost-profile-untangle.md) | Cost Profile Untangle | accepted | 2026-06-01 | — |
-| [ADR-038](ADR-038-canonical-settings-path.md) | Canonical Settings Path | accepted | 2026-06-01 | — |
-| [ADR-039](ADR-039-claude-skills-untracked.md) | Claude Skills Untracked | accepted | 2026-06-01 | — |
-| [ADR-040](ADR-040-execution-model-projection-time-filtering.md) | Execution Model Projection Time Filtering | accepted | 2026-06-02 | — |
-| [ADR-041](ADR-041-controlled-command-verbs.md) | Controlled Command Verbs | accepted | 2026-06-03 | — |
-| [ADR-042](ADR-042-runtime-resolver-decision-gate.md) | Runtime Resolver Decision Gate | accepted | 2026-06-03 | — |
-| [ADR-043](ADR-043-monorepo-collapse-to-src-domains.md) | Monorepo Collapse To Src Domains | accepted | 2026-06-03 | ADR-017 |
-| [ADR-044](ADR-044-command-naming-scheme-hyphenated.md) | Command Naming Scheme Hyphenated | accepted | 2026-06-03 | — |
-| [ADR-045](ADR-045-src-source-layout-and-profiles-as-views.md) | Src Source Layout And Profiles As Views | accepted | 2026-06-03 | ADR-028 |
-| [ADR-046](ADR-046-thin-command-principle.md) | Thin Command Principle | accepted | 2026-06-03 | — |
-| [ADR-047](ADR-047-framework-neutral-stack-adaptive-commands.md) | Framework Neutral Stack Adaptive Commands | accepted | 2026-06-03 | — |
-| [ADR-048](ADR-048-command-justification-rule.md) | Command Justification Rule | accepted | 2026-06-03 | — |
-| [ADR-049](ADR-049-configuration-trust-boundary.md) | Configuration Trust Boundary | accepted | 2026-06-03 | — |
-| [ADR-050](ADR-050-workspace-vs-package-root-boundary.md) | Workspace Vs Package Root Boundary | accepted | 2026-06-05 | — |
-| [ADR-051](ADR-051-uncondensed-source-container-relocation.md) | Uncondensed Source Container Relocation | accepted | 2026-06-05 | — |
-| [ADR-052](ADR-052-packages-removal-and-pack-home-migration.md) | Packages Removal And Pack Home Migration | accepted | 2026-06-05 | — |
-| [ADR-053](ADR-053-agents-namespace-dual-role-resolution.md) | Agents Namespace Dual Role Resolution | accepted | 2026-06-05 | — |
-| [ADR-054](ADR-054-rule-adherence-decay-triggered-restate.md) | Rule Adherence Decay Triggered Restate | proposed | 2026-06-05 | — |
-| [ADR-055](ADR-055-flow-layer-data-model.md) | Flow Layer Data Model | proposed | 2026-06-06 | — |
-| [ADR-056](ADR-056-unvalidated-video-adapters-disposition.md) | Unvalidated Video Adapters Disposition | accepted | 2026-06-06 | — |
-| [ADR-057](ADR-057-consolidation-evidence-gate-outcomes.md) | Consolidation Evidence Gate Outcomes | proposed | 2026-06-06 | — |
-| [ADR-058](ADR-058-condensed-output-relocation-to-dist.md) | Condensed Output Relocation To Dist | accepted | 2026-06-06 | — |
-| [ADR-059](ADR-059-render-resume-filesystem-as-state.md) | Render Resume Filesystem As State | accepted | 2026-06-07 | — |
-| [ADR-060](ADR-060-comfyui-sandbox-model.md) | Comfyui Sandbox Model | accepted | 2026-06-07 | — |
-| [ADR-061](ADR-061-corpus-grounding-layer.md) | Corpus Grounding Layer | accepted | 2026-06-07 | — |
-| [ADR-062](ADR-062-encrypt-at-rest-store-architecture.md) | Encrypt At Rest Store Architecture | accepted | 2026-06-08 | — |
-| [ADR-063](ADR-063-append-jsonl-encryption-deferred.md) | Append Jsonl Encryption Deferred | accepted | 2026-06-08 | — |
-| [ADR-064](ADR-064-append-jsonl-per-record-encryption.md) | Append Jsonl Per Record Encryption | accepted | 2026-06-08 | — |
-| [ADR-065](ADR-065-tier3-inbox-handoff-v0.md) | Tier3 Inbox Handoff V0 | accepted | 2026-06-08 | — |
-| [ADR-066](ADR-066-skill-body-prerendering.md) | Skill Body Prerendering | accepted | 2026-06-08 | — |
-| [ADR-067](ADR-067-glama-registry-listing.md) | Glama Registry Listing | proposed | 2026-06-08 | — |
-| [ADR-068](ADR-068-host-tier-detection.md) | Host Tier Detection | accepted | 2026-06-08 | — |
-| [ADR-069](ADR-069-prompt-renderer.md) | Prompt Renderer | accepted | 2026-06-08 | — |
-| [ADR-070](ADR-070-tier1-drive-loop.md) | Tier1 Drive Loop | accepted | 2026-06-08 | — |
-| [ADR-071](ADR-071-launch-drive-integration.md) | Launch Drive Integration | accepted | 2026-06-08 | — |
-| [ADR-072](ADR-072-codex-gemini-drive-configs.md) | Codex Gemini Drive Configs | accepted | 2026-06-08 | — |
-| [ADR-073](ADR-073-drive-health-kill-switch.md) | Drive Health Kill Switch | accepted | 2026-06-08 | — |
-| [ADR-074](ADR-074-drive-kill-switch-auto-recovery.md) | Drive Kill Switch Auto Recovery | accepted | 2026-06-08 | — |
-| [ADR-075](ADR-075-workspace-gui-drive.md) | Workspace Gui Drive | accepted | 2026-06-08 | — |
-| [ADR-076](ADR-076-workspace-multi-turn.md) | Workspace Multi Turn | accepted | 2026-06-09 | — |
-| [ADR-077](ADR-077-workspace-followup-gui.md) | Workspace Followup Gui | accepted | 2026-06-09 | — |
-| [ADR-078](ADR-078-drive-health-panel.md) | Drive Health Panel | accepted | 2026-06-09 | — |
-| [ADR-079](ADR-079-workspace-host-picker.md) | Workspace Host Picker | accepted | 2026-06-09 | — |
-| [ADR-080](ADR-080-host-session-expired-410.md) | Host Session Expired 410 | accepted | 2026-06-09 | — |
-| [ADR-081](ADR-081-drive-health-reset-and-410-affordance.md) | Drive Health Reset And 410 Affordance | accepted | 2026-06-09 | — |
-| [ADR-082](ADR-082-410-one-click-relaunch.md) | 410 One Click Relaunch | accepted | 2026-06-09 | — |
-| [ADR-083](ADR-083-session-thread-and-arbitrary-continuation.md) | Session Thread And Arbitrary Continuation | accepted | 2026-06-09 | — |
-| [ADR-084](ADR-084-drive-health-refresh-on-drive.md) | Drive Health Refresh On Drive | accepted | 2026-06-09 | — |
-| [ADR-085](ADR-085-mcp-stdio-end-user-distribution-shape.md) | Mcp Stdio End User Distribution Shape | accepted | 2026-06-10 | — |
-| [ADR-086](ADR-086-read-only-cross-agent-mcp-discovery-helper.md) | Read Only Cross Agent Mcp Discovery Helper | rejected | 2026-06-11 | — |
-| [ADR-087](ADR-087-installer-e2e-test-strategy.md) | Installer E2E Test Strategy | accepted | 2026-06-11 | — |
-| [ADR-088](ADR-088-no-external-runtime-federation.md) | No External Runtime Federation | accepted | 2026-06-11 | — |
-| [ADR-089](ADR-089-lean-local-plugin-install.md) | Lean Local Plugin Install | accepted | 2026-06-12 | — |
-| [ADR-090](ADR-090-visibility-command-frontmatter-field.md) | Visibility Command Frontmatter Field | accepted | 2026-06-13 | — |
-| [ADR-091](ADR-091-split-meta-capability-packs.md) | Split Meta Capability Packs | accepted | 2026-06-13 | — |
-| [ADR-092](ADR-092-defer-command-tier-alias-removal.md) | Defer Command Tier Alias Removal | accepted | 2026-06-13 | — |
-| [ADR-093](ADR-093-ai-council-config-user-global.md) | Ai Council Config User Global | superseded | 2026-06-13 | — |
-| [ADR-094](ADR-094-agent-memory-layer-removal.md) | Agent Memory Layer Removal | accepted | 2026-06-14 | — |
-| [ADR-095](ADR-095-workspace-boundary-contract.md) | Workspace Boundary Contract | accepted | 2026-06-14 | — |
-| [ADR-096](ADR-096-analysis-workbench.md) | Analysis Workbench | accepted | 2026-06-15 | — |
-| [ADR-097](ADR-097-mission-recipe-privilege-boundary.md) | Mission Recipe Privilege Boundary | accepted | 2026-06-15 | — |
-| [ADR-098](ADR-098-evidence-first-structure-discovery.md) | Evidence First Structure Discovery | accepted | 2026-06-15 | — |
-| [ADR-099](ADR-099-file-first-pattern-library.md) | File First Pattern Library | accepted | 2026-06-15 | — |
-| [ADR-100](ADR-100-global-knowledge-card-sharing.md) | Global Knowledge Card Sharing | accepted | 2026-06-15 | ADR-098 |
-| [ADR-101](ADR-101-ticket-bundle-emission.md) | Ticket Bundle Emission | proposed | 2026-06-15 | — |
-| [ADR-102](ADR-102-ticket-handoff-paste-and-mcp.md) | Ticket Handoff Paste And Mcp | accepted | 2026-06-16 | — |
-| [ADR-103](ADR-103-global-knowledge-default-off-until-measured.md) | Global Knowledge Default Off Until Measured | superseded | 2026-06-16 | — |
-| [ADR-104](ADR-104-ai-council-config-global-only.md) | Ai Council Config Global Only | accepted | 2026-06-22 | 093 |
-| [ADR-105](ADR-105-automatic-subagent-orchestration.md) | Automatic Subagent Orchestration | accepted | 2026-06-23 | — |
-| [ADR-106](ADR-106-recursive-verification-benchmark-gate.md) | Recursive Verification Benchmark Gate | accepted | 2026-06-23 | — |
-| [ADR-107](ADR-107-legal-domain-pack-adoption.md) | Legal Domain Pack Adoption | accepted | 2026-06-24 | — |
-| [ADR-108](ADR-108-open-source-forever-no-commercial-tier.md) | Open Source Forever No Commercial Tier | accepted | 2026-06-24 | — |
-| [ADR-109](ADR-109-subagent-v1-contract.md) | Subagent V1 Contract | accepted | 2026-07-04 | — |
-| [ADR-110](ADR-110-discipline-profile-resolution-locus.md) | Discipline Profile Resolution Locus | accepted | 2026-07-07 | — |
-| [ADR-111](ADR-111-canonical-glama-listing.md) | Canonical Glama Listing | accepted | 2026-07-07 | — |
-| [ADR-112](ADR-112-stdio-lite-stays-read-only.md) | Stdio Lite Stays Read Only | accepted | 2026-07-07 | — |
-| [ADR-113](ADR-113-ci-native-release-label-trigger.md) | Ci Native Release Label Trigger | accepted | 2026-07-08 | — |
-| [ADR-114](ADR-114-commit-policy-iron-law-override.md) | Commit Policy Iron Law Override | accepted | 2026-07-08 | — |
-| [ADR-115](ADR-115-command-cluster-consolidation-phase-4.md) | Command Cluster Consolidation Phase 4 | accepted | 2026-07-08 | — |
-| [ADR-116](ADR-116-memory-tripwire-activation-path.md) | Memory Tripwire Activation Path | accepted | 2026-07-08 | — |
-| [ADR-117](ADR-117-subagents-auto-default-on.md) | Subagents Auto Default On | accepted | 2026-07-09 | — |
-| [ADR-118](ADR-118-loop-engineering-boundaries.md) | Loop Engineering Boundaries | accepted | 2026-07-10 | — |
-| [ADR-119](ADR-119-global-knowledge-default-on.md) | Global Knowledge Default On | accepted | 2026-07-12 | 103 |
-| [ADR-120](ADR-120-council-chairman-mode.md) | Council Chairman Mode | accepted | 2026-07-12 | — |
-| [ADR-121](ADR-121-knowledge-sensitivity-classes.md) | Knowledge Sensitivity Classes | accepted | 2026-07-12 | — |
-| [ADR-122](ADR-122-adversarial-verification-council.md) | Adversarial Verification Council | accepted | 2026-07-14 | — |
-| [ADR-123](ADR-123-runtime-security-scope-and-spawn-hardening.md) | Runtime Security Scope And Spawn Hardening | accepted | 2026-07-20 | — |
-| [ADR-200](ADR-200-python-to-typescript-migration.md) | Python To Typescript Migration | accepted | 2026-06-11 | — |
-
-## Unnumbered (legacy)
-
-| # | Title | Status | Date | Supersedes |
-|---|---|---|---|---|
-| [ADR-rule-kernel-and-router](ADR-rule-kernel-and-router.md) | Rule Kernel And Router Roadmap Closure | accepted | 2026-05-06 | — |