@event4u/agent-config 9.7.0 → 9.9.0

package/dist/agent-src/commands/pr/create.md

@@ -53,6 +53,10 @@ Uses `/create-pr:description-only` to generate the PR content, then creates the
 - Verify the current branch is NOT the default branch (`main` / `master`).
 - Run `git status` — warn if there are uncommitted changes.
 - Run `git log origin/{default}..HEAD --oneline` to verify there are commits to push.
+- **Secret-leak pre-flight (MANDATORY before push):** run
+  `./scripts-run src/scripts/check_secret_leak`. On a high-confidence hit, STOP —
+  do not push; hand to `.augment/rules/secret-vcs-guard.md` (show, ask, offer the
+  alternative, rotate-first if already in history). Pushing publishes the secret.
 - If the branch has not been pushed yet, ask the user (in their language) whether to push.
 
 ### 1b. Freshness gate — MANDATORY before opening any PR

package/dist/agent-src/commands/research.md

@@ -55,7 +55,7 @@ for narrative structure, mental-models lens for object selection).
 - **Do NOT chain sub-commands.** One `/research[:<sub>]` per turn.
 - If the user invokes `/research` with no argument, **show the menu** —
   do not guess whether they meant the bare workflow or a sub-command.
-- **Edit `.agent-src.uncondensed/` only.** `dist/agent-src/` and `.augment/`
+- **Edit `src/` only.** `dist/agent-src/` and `.augment/`
   regenerate from source.
 
 ## Trigger

package/dist/agent-src/commands/roadmap/ai-council.md

@@ -27,7 +27,7 @@ Council-driven challenge + refactor scope of the
 artefact), then drives the user through applying convergence
 findings as numbered patches against the roadmap file.
 
-**Source of truth:** `.agent-src.uncondensed/` — never read or edit
+**Source of truth:** `src/` — never read or edit
 `dist/agent-src/` or `.augment/` directly.
 
 ## Instructions

package/dist/agent-src/commands/security-audit-config.md

@@ -36,7 +36,7 @@ suite's own `lint_agent_security` self-audit gate.
 
 (omit `--root` to audit the current repo). The script reuses the Phase-1
 detection library under the false-positive containment convention
-([`security-lint-containment`](../../docs/guidelines/agent-infra/security-lint-containment.md)),
+([`security-lint-containment`](../docs/guidelines/agent-infra/security-lint-containment.md)),
 so doc/example files do not tank the score. It scans instruction files
 (`CLAUDE.md`, `AGENTS.md`, `.cursor/rules`, `.github/copilot-instructions.md`,
 `.clinerules`, `.windsurfrules`), MCP configs (`.mcp.json`, `.cursor/mcp.json`,

package/dist/agent-src/commands/team/delegate.md

@@ -50,6 +50,10 @@ refuse with the enable pointer and **STOP**:
 >
 > Key reference: `docs/contracts/ai-team-config.md`.
 
+Deterministic mirror of gates 1+2: `npx tsx src/scripts/ai_team/team_dispatch.ts
+--delegate-gate` exits non-zero (pointer on stderr) unless BOTH flags true — run
+it instead of hand-parsing YAML when a shell is available.
+
 ### 3. Gate — plugin presence (fail closed)
 
 On a Claude Code host, verify the official plugin is installed. Absent →

package/dist/agent-src/commands/video.md

@@ -68,7 +68,7 @@ contract under [`scripts/media/lib/adapter-contract.md`](../../scripts/media/lib
 - **Run `validate-deps.sh` first.** Every subcommand calls
   `scripts/ai-video/lib/validate-deps.sh` before any adapter; fails
   fast on missing personas / skills.
-- **Edit `.agent-src.uncondensed/` only.** Generated mirrors regenerate.
+- **Edit `src/` only.** Generated mirrors regenerate.
 
 ## See also
 

package/dist/agent-src/contexts/authority/kernel-rule-edits.md

@@ -2,7 +2,7 @@
 
 Loaded by [`scope-control`](../../rules/scope-control.md). Codifies the
 soak-time guarantee for edits to always-loaded (kernel) rules under
-`.agent-src.uncondensed/rules/`.
+`src/rules/`.
 
 **Size budget:** ≤ 1,500 chars.
 

package/dist/agent-src/contexts/contracts/emergency-triage-block.md

@@ -26,7 +26,7 @@ Use this variant in `AGENTS.md` at the package root.
 
 ## Consumer-template variant
 
-Use this variant in `.agent-src.uncondensed/templates/AGENTS.md`. The
+Use this variant in `src/agent-src/templates/AGENTS.md`. The
 consumer's `AGENTS.md` lands at the consumer-project root after install.
 
 ```
@@ -45,7 +45,7 @@ The package-root and the consumer template answer the same five
 questions but in different repos:
 
 - The package-root variant points at this repo's authoring layer
-  (`.agent-src.uncondensed/`) and the package's CI entry point.
+  (`src/`) and the package's CI entry point.
 - The consumer variant tells the agent it is in a **consumer** project
   where `.augment/` is an installed artifact and editing it is wrong.
 

package/dist/agent-src/contexts/execution/auto-dispatch-classification.md

@@ -85,6 +85,49 @@ Every inferred decision records `tier_source: "inferred"` in orchestration
 telemetry (static pins record `"static"`; session-tier runs `"inherit"`) so
 the evidence gate scores inferred routing separately from static pinning.
 
+## Lookup-class rung (L0 — road-to-lean-agent-init, BELOW the tiers)
+
+Before any spawn decision, a lookup-shaped task routes to a **deterministic
+primitive** — no subagent, no tier. Live evidence (2026-07-28): four
+`general-purpose` workers burned ~1.21M tokens on four lookup tasks a
+primitive answers for <1k each.
+
+```
+LOOKUP-SHAPED TASK → DETERMINISTIC PRIMITIVE. NO SUBAGENT SPAWN.
+INDEX-MISS OR GENUINE AMBIGUITY → REGULAR ESCALATION TO A SUBAGENT —
+NEVER A SILENTLY DEGRADED ANSWER. NO LLM CLASSIFIER FALLBACK (CUT C3).
+```
+
+| Task pattern | Lookup class | Primitive |
+|---|---|---|
+| "where is X defined" / "confirm X's definition location" | `definition` | capped `rg` (definition-shaped patterns, `--max-count`); `code_graph query` only as opportunistic accelerant when an index is present + fresh + `hooks.code_graph.enabled: true` |
+| "who calls / imports X" / "confirm call sites" | `references` | capped `rg` (reference-shaped patterns); same optional `code_graph affected` accelerant clause |
+| "does string Y exist" / "probe candidate strings" | `string-existence` | FTS one-shot (`memory_lookup` for the knowledge corpus) or capped `rg -n --max-count` for the codebase |
+| "run report Z" / "run check_*" | `report-run` | direct script run, wrapped per the **measured** rtk allowlist (`internal/bench/rtk-savings/RESULTS.md` — wrap only the ~55%-savings class) |
+
+**Why rg-first for definition/references** (council debate 2026-07-28,
+claude-sonnet-4-5 + gpt-4o, 2 rounds): the pre-registered benchmark behind the
+`code-graph-retrieval-null` claim (`docs/CLAIMS.md`) measured native-graph
+recall 0.365 vs grep 0.797 on graph-shaped questions, root cause an **indexing
+gap** (TS arrow-function exports produce no symbol nodes) that hits structured
+lookups exactly as it hits NL retrieval — and the recorded consequence bound
+keeps `code_graph.enabled` false permanently. The accelerant clause is the
+escape hatch that bound names ("unless external evidence appears"); today
+inert.
+
+**Escalation, not degradation:** a primitive returning nothing (index miss,
+ambiguous pattern, absent report script) — **or an unusable result** (empty,
+ambiguous between candidates, or visibly off-target because the lookup
+pattern matched a task that was not actually a lookup, e.g. a dynamically
+constructed symbol name) — escalates to the regular classification path —
+answer-quality bar never drops. "Primitive ran but result unusable"
+escalates exactly like "class unknown". `unknown` resolves to the regular
+path (`inherit` semantics), never down-guessed.
+
+Correctness floor: golden comparison in `internal/bench/lean-init/`
+(primitive answer ≡ agent answer on ≥10 lookup tasks, incl. the four observed
+shapes); any mismatch is a routing bug, not a rounding error.
+
 ## v2+ (deferred, gated on Phase 6 evidence)
 
 LLM-based classification — only if the deterministic rules prove too coarse
@@ -95,8 +138,11 @@ budgeted (consume part of the N=3 autonomous budget) and opt-in. Not in v1.
 
 The deterministic rules are encoded in
 [`src/scripts/_lib/auto_dispatch.ts`](../../../../src/scripts/_lib/auto_dispatch.ts)
-(`classifyTask`), covered by
-[`tests/scripts/_lib_auto_dispatch.test.ts`](../../../../tests/scripts/_lib_auto_dispatch.test.ts).
+(`classifyTask`, `classifyLookup` for the lookup-class rung), covered by
+[`tests/scripts/_lib_auto_dispatch.test.ts`](../../../../tests/scripts/_lib_auto_dispatch.test.ts)
+and the lookup corpus in
+[`src/scripts/_lib/auto_dispatch.corpus.test.ts`](../../../../src/scripts/_lib/auto_dispatch.corpus.test.ts)
+(`LOOKUP_CORPUS` — the four live-observed shapes + negative controls).
 
 ## Related
 

package/dist/agent-src/contexts/execution/orchestration-telemetry.md

@@ -56,6 +56,16 @@ v1 forward-compat rule on unknown fields).
 | `session_tier` | string \| null | **Cost-% extension.** The orchestrator's OWN tier — the baseline the downshift cost-% measures `tier_chosen` against (a `high`→`lite` downshift is a rate win the token count can't see). `null` = not recorded. |
 | `first_pass_success` | bool \| null | **QUALITY extension (council verdict: quality × cost paired).** `true` = the subagent return was adopted without parent rework; `false` = the parent had to rework the return before adopting. Precise rework definition: § Operationalization below. `null` = pre-extension line / not measured. Boolean only, no bodies. |
 | `escalated` | bool \| null | **QUALITY extension (council verdict: quality × cost paired).** `true` = the slice was retried on a higher tier after a verification failure; `false` = no escalation. Semantics: § Operationalization below. `null` = pre-extension line / not measured. Boolean only, no bodies. |
+| `init_tokens` | int \| null | **Lean-init extension (road-to-lean-agent-init Phase 3).** Spawn-payload tokens at worker init — the payload-truth measurement feeding the Phase-5 baseline gate (p95 < ~1,500 tokens/worker drops the L2/L3 bets). `null` = not measured. Counts only. |
+| `payload_hash` | string \| null | **Lean-init extension.** 8–64-char hex digest of the spawn payload — prefix-stability / cache measurement. A hash can never smuggle content (privacy by construction). `null` = not measured. |
+| `lookup_class` | enum \| null | **Lean-init extension.** Lookup class the L0 rung matched: `definition` · `references` · `string-existence` · `report-run`. `null` = not a lookup-shaped dispatch. |
+| `route_taken` | enum \| null | **Lean-init extension.** `primitive` (deterministic primitive answered — no spawn) · `subagent` (escalated). With `lookup_class`, measures the tool-not-agent rung's hit rate. A `primitive` line is the ONE recordable zero-spawn event (`spawn_count: 0`) — the routing decision itself is the datum the cost claim reads. |
+| `budget_hit` | bool \| null | **Lean-init extension.** Worker hit its `max_tokens_per_worker` stop-loss (L0b) and returned the structured partial result. Feeds budget-seed refinement. `null` = not measured. |
+| `correctness_match` | bool \| null | **Lean-init extension.** Golden/correctness comparison verdict for a primitive route (primitive answer ≡ agent answer). Populated only when a comparison arm actually ran (bench/golden mode); on real zero-spawn primitive routes there is no agent answer to compare against, so `null` is the NORMAL field value — never read `null` as "unchecked = suspicious". |
+| `cache_hit` | bool \| null | **Lean-init extension (Phase 4 prefix stability).** Provider-reported prompt-cache hit on the spawn payload. Measurement only — no savings claim without provider-response evidence. `null` = not measured. |
+| `origin` | string \| null | **Lean-init extension (council Q5 segregation).** Id-shaped sample tag (`lean-init-2026`) keeping lean-init efficiency lines cleanly separable from the `road-to-orchestration-scope-decision` sample. `null` = untagged line. Never free-form. |
+| `rules_carried` | int \| null | **Lean-init extension (L6 demand signal).** Rules in the worker's scoped projection — the carried set. With `rules_used`, yields the per-worker rule-usage quota the parked `later/road-to-deferred-rule-retriever` resume condition asks for ("are worker rules actually carried unused?"). `null` = not measured. Counts only. |
+| `rules_used` | int \| null | **Lean-init extension (L6 demand signal).** Rules the worker actually applied/cited. Validation: never exceeds `rules_carried`. `null` = not measured. Counts only. |
 
 These routing + cost fields are additive and optional — a line without them is
 still a valid orchestration line; readers ignore unknown fields per the v1

package/dist/agent-src/contexts/execution/subagent-modes-detail.md

@@ -1,11 +1,112 @@
-# Subagent Modes — worktree + live-app-judge + adversarial-council detail
-
-Extended detail for the heaviest [`subagent-orchestration`](../../skills/subagent-orchestration/SKILL.md)
-modes — `do-in-worktrees` (mode 7), `do-with-live-app-judge` (mode 8), and
-`adversarial-verification-council` (mode 9). Split out of the skill body to keep
-it under the size budget; the mode list, selection rules, and the six common
-modes stay inline in the skill. Pull this when you actually dispatch one of these
-modes.
+# Subagent Modes — per-mode detail (decision rows, contracts, heavy modes)
+
+Extended detail for the [`subagent-orchestration`](../../skills/subagent-orchestration/SKILL.md)
+modes. Split out of the skill body to keep it under the size budget; the mode
+list, form gate, selection rules, and procedure stay inline in the skill. Pull
+this when you dispatch a mode and need its decision row, execution contract, or
+the heavy-mode detail (modes 7–9).
+
+## Modes 1–6 — decision rows and execution contracts
+
+### Mode 1 — do-and-judge
+
+| When to use | When not | Model pairing |
+|---|---|---|
+| Single-change task with non-trivial risk | Tiny fix, or spike/exploration | implementer = session; judge = one tier up |
+
+### Mode 2 — do-and-judge-two-stage
+
+Implementer produces a diff; **two judges run sequentially** — first a
+spec-compliance reviewer (does the diff satisfy the stated spec /
+acceptance criteria?), then a code-quality reviewer (is the diff well-
+written for the codebase it lands in?). The orchestrator only proceeds
+to stage two if stage one returns `DONE` or `DONE_WITH_CONCERNS`. A
+stage-one `BLOCKED` shortcuts the loop — there is no point quality-
+reviewing a diff that does not satisfy the spec.
+
+| When to use | When not | Model pairing |
+|---|---|---|
+| Spec is contested or AC are detailed; diff size makes one judge prone to missing one axis (correctness vs craft) | Spec is one sentence, or the diff is one line (collapse to mode 1) | implementer = session; spec-judge = one tier up; quality-judge = same tier as spec-judge, fresh context |
+
+**Why two stages, not one judge with both rubrics:** combining the
+rubrics in one prompt reliably regresses one of them — the judge "spends
+attention" on whichever rubric appears last. Splitting the prompts
+forces each judge to commit fully to its rubric.
+
+**Stage-routing rule:**
+- Stage-1 returns `DONE` → run stage-2.
+- Stage-1 returns `DONE_WITH_CONCERNS` → run stage-2; concerns carry
+  forward to the final envelope.
+- Stage-1 returns `NEEDS_CONTEXT` → pause; stage-2 does not run.
+- Stage-1 returns `BLOCKED` → final verdict is `BLOCKED`; stage-2
+  does not run (saves cost).
+
+### Mode 3 — do-in-steps
+
+| When to use | When not | Model pairing |
+|---|---|---|
+| Multi-step plan with ordered dependencies | Single-step change, or when steps are independent (use `do-in-parallel`) | implementer = session; judge = one tier up |
+
+### Mode 4 — do-in-parallel
+
+| When to use | When not | Model pairing |
+|---|---|---|
+| Independent slices (different files, non-overlapping) | Any slice touches shared state | implementer = session; judge = one tier up, run once |
+
+### Mode 5 — do-competitively
+
+| When to use | When not | Model pairing |
+|---|---|---|
+| Broad solution space (algorithm choice, API shape) | Well-defined problem with one good answer | implementers = same tier (≥2 instances); judge = one tier up |
+
+### Mode 6 — judge-with-debate
+
+| When to use | When not | Model pairing |
+|---|---|---|
+| Security, data integrity, public API change | Routine internal refactor | judges = same tier (2x); meta-judge = one tier up |
+
+## Severity-conditioned team composition — conditions pattern
+
+Guidance, not a new object class (persona-catalog disposition; AI council
+2026-07-27, claude-sonnet-4-5 + gpt-4o: capture as guidance on this
+existing surface — no roster schema, no linter, no fourth scoping
+ontology). Incident-style severity tiers refine composition and
+activation **within** the form the static gate already picked — severity
+never overrides the form gate, the Iron Law, or any safety floor.
+
+| Severity | Composition + activation | Existing mode(s) |
+|---|---|---|
+| Critical — prod impact, security, data integrity | Full parallel team; debate-grade review on the aggregate | `do-in-parallel` + `judge-with-debate` (Mode 9 where opted in) |
+| High — contested spec, cross-layer risk | Implementer + two sequential judges | `do-and-judge-two-stage` |
+| Medium — routine multi-step | Implementer + judge between steps | `do-in-steps` / `do-and-judge` |
+| Low — small, reversible | Solo with async review | in-session (`none`); optional single async judge |
+
+At equal severity the cheapest-mode preference (skill § 3. Pick the mode)
+still applies; escalate one tier only on a named risk signal, never on
+vibes.
+
+## Status taxonomy — rationale and routing semantics
+
+Every implementer or judge return conforms to
+[`schemas/subagent-status.json`](../../../skills/subagent-orchestration/schemas/subagent-status.json).
+Four statuses, no free-form alternatives:
+
+| Status | Meaning | Required keys (beyond `status`, `summary`) |
+|---|---|---|
+| `DONE` | Work shipped, all gates green. | `evidence[]` |
+| `DONE_WITH_CONCERNS` | Work shipped but caller must act on concerns. | `evidence[]`, `concerns[]` |
+| `NEEDS_CONTEXT` | Paused; caller can unblock by answering. | `blocking_question` |
+| `BLOCKED` | No path forward exists. | `blocking_reason` |
+
+**Why a fixed taxonomy:** orchestrators (`/do-and-judge`, `/do-in-steps`)
+route on status. Free-form "kind of done" returns force the orchestrator
+to interpret prose, which silently regresses the two-revision ceiling and
+the judge-rejected-do-not-apply rule. The schema makes routing mechanical.
+
+**Distinguishing `NEEDS_CONTEXT` from `BLOCKED`:** `NEEDS_CONTEXT` means
+*"you, the caller, can fix this by telling me X"*. `BLOCKED` means
+*"no input from you unblocks this — escalate or rescope"*. If a subagent
+is unsure, it picks `BLOCKED` and the caller can downgrade.
 
 ## Mode 7 — do-in-worktrees
 

package/dist/agent-src/contexts/execution/subagent-response-contract.md

@@ -21,6 +21,26 @@ orchestrator synthesises and re-verifies.
   never inline content — same minimal-slice / privacy floor as the spawn contract.
 - `mutating` marks a finding whose action changes files/state (feeds the verify link).
 
+## Budget-hit partial result
+
+Worker's `max_tokens_per_worker` stop-loss fires
+([spawn contract § Per-worker token stop-loss](subagent-spawn-contract.md#per-worker-token-stop-loss-l0b--hard-budget-structured-escalation))
+→ return is `BLOCKED` envelope whose body is this shape instead:
+
+```json
+{
+  "budget_hit": true,
+  "found": ["file:line | id | path"],
+  "remaining": "<what stays unexplored, one sentence>",
+  "suggested_next_rung": "primitive | higher-tier-subagent | in-session"
+}
+```
+
+`budget_hit: true` is the escalation flag; `found` follows same
+refs-not-bodies floor as `evidence_refs`. Validator:
+`worker_budget.validateWorkerPartialResult` — orchestrator never adopts
+invalid partial return.
+
 ## Orchestrator synthesis duties
 
 ```

package/dist/agent-src/contexts/execution/subagent-spawn-contract.md

@@ -13,7 +13,8 @@ task without re-inventing any taxonomy.
   "role_mode": "developer|reviewer|tester|po|incident|planner|null",
   "profile": "<active profile id or null>",
   "personas": ["<persona id>", "..."],
-  "knowledge_refs": ["<id-or-path>", "..."]
+  "knowledge_refs": ["<id-or-path>", "..."],
+  "max_tokens_per_worker": 15000
 }
 ```
 
@@ -41,6 +42,28 @@ private-data leg stays narrow: the composer rejects inline bodies (multi-line /
 oversized entries), accepts only ref-like tokens, and caps the count. Anything
 dropped is recorded in `warnings` and surfaced — never silently widened.
 
+## Per-worker token stop-loss (L0b) — hard budget, structured escalation
+
+```
+EVERY DISPATCHED WORKER CARRIES A max_tokens_per_worker BUDGET FOR ITS TIER.
+ON HIT: RETURN A STRUCTURED PARTIAL RESULT + ESCALATION FLAG — STOP EXPLORING.
+A WORKER OVERRUNNING ITS BUDGET 20× IS A DISPATCH ERROR ON THE WRONG RUNG,
+NOT DILIGENCE.
+```
+
+Budgets keyed by the worker's resolved tier
+(`worker_budget.budgetForTier`; start values `lite: 15k` — the lookup-class
+seed — `medium: 60k`, `high: 150k`, refined from `budget_hit` telemetry, never
+final). On hit the worker returns a `BLOCKED` envelope whose body is the
+partial-result shape from the
+[response contract](subagent-response-contract.md#budget-hit-partial-result):
+what was found (refs), what remains, suggested next rung. The stop-loss
+**composes** with the N=3 validation budget
+([`autonomous-execution`](../../rules/autonomous-execution.md)) and the
+ADR-109 response contract — replaces nothing. Live evidence (2026-07-28):
+four lookup-class workers burned 280–327k tokens each on tasks a
+deterministic primitive answers for <1k.
+
 ## Bundle resolver — bind to the existing surfaces
 
 The brief is **resolved**, not hand-built. `resolveBundle(slice)` maps a task
@@ -64,9 +87,36 @@ only, never bodies.
 
 [`src/scripts/_lib/subagent_spawn.ts`](../../../../src/scripts/_lib/subagent_spawn.ts)
 (`composeSpawnBrief`) + [`src/scripts/_lib/subagent_bundle.ts`](../../../../src/scripts/_lib/subagent_bundle.ts)
-(`resolveBundle`, `filterKnowledgeByPolicy`, `bundleAuditLine`), covered by
+(`resolveBundle`, `filterKnowledgeByPolicy`, `bundleAuditLine`) +
+[`src/scripts/_lib/worker_budget.ts`](../../../../src/scripts/_lib/worker_budget.ts)
+(`budgetForTier`, `evaluateWorkerBudget`, `validateWorkerPartialResult`),
+covered by
 [`tests/scripts/_lib_subagent_spawn.test.ts`](../../../../tests/scripts/_lib_subagent_spawn.test.ts)
-+ [`tests/scripts/_lib_subagent_bundle.test.ts`](../../../../tests/scripts/_lib_subagent_bundle.test.ts).
++ [`tests/scripts/_lib_subagent_bundle.test.ts`](../../../../tests/scripts/_lib_subagent_bundle.test.ts)
++ [`tests/scripts/_lib_worker_budget.test.ts`](../../../../tests/scripts/_lib_worker_budget.test.ts)
+(the budget-hit partial-result fixture).
+
+## Worker rtk allowlist — wrap only the measured class
+
+Worker tool loops wrap a command with rtk **only** when that command class
+measured ≥ ~50% output saving in `internal/bench/rtk-savings/RESULTS.md`
+(`git status`, full-format `git log -N`, `ls -la`); the ~0%-class
+(`--oneline`, `--stat` views, `npm ls`) stays unwrapped — wrap overhead
+without return. Deterministic list: `src/scripts/_lib/rtk_allowlist.ts`
+(`shouldWrapWithRtk`); congruence with RESULTS.md is test-enforced
+(`tests/scripts/_lib_rtk_allowlist.test.ts`) — numbers live in the bench
+file, referenced, never duplicated.
+
+## Prefix stability — deterministic payload ordering
+
+Spawn payloads serialize **static prefix first** (role contract, profile,
+personas, budget — byte-identical across dispatches of the same
+configuration), **variable task part last**; no timestamps, no random IDs
+(`serializeSpawnPayload` / `spawnPayloadHash`). Provider prompt-caching keys
+on the stable prefix; `payload_hash` + `cache_hit` audit fields
+([`orchestration-telemetry`](orchestration-telemetry.md)) measure whether it
+actually hits. Measurement only — no savings claim without provider-response
+evidence.
 
 ## Worker-prompt rules — verbatim at spawn
 

package/dist/agent-src/contexts/override-system.md

@@ -19,12 +19,58 @@ When an agent loads any skill, rule, command, guideline, or template:
 ```
 1. Load original from .augment/{type}/{name}
 2. Check agents/overrides/{type}/{name} exists?
-   ├── YES → Read Mode header
-   │   ├── extend  → Apply original FIRST, then layer override on top
-   │   └── replace → Skip original entirely, use override only
+   ├── YES → Is the target a KERNEL or safety-floor rule?
+   │   ├── YES → replace → REFUSE. Report it. Keep the original.
+   │   │         extend  → allowed ONLY with a registered exception (below)
+   │   └── NO  → Read Mode header
+   │             ├── extend  → Apply original FIRST, then layer override on top
+   │             └── replace → Skip original entirely, use override only
    └── NO  → Use original unchanged
 ```
 
+## The non-overridable class
+
+```
+A KERNEL OR SAFETY-FLOOR RULE MAY BE TIGHTENED, NEVER REPLACED OR RELAXED.
+A `replace`-MODE OVERRIDE ON ONE IS REFUSED AND REPORTED — NEVER SILENTLY APPLIED.
+AN `extend` ON ONE REQUIRES A REGISTERED, JUSTIFIED EXCEPTION.
+```
+
+The nine kernel rules — `agent-authority`, `ask-when-uncertain`, `commit-policy`,
+`direct-answers`, `language-and-tone`, `no-cheap-questions`,
+`non-destructive-by-default`, `scope-control`, `verify-before-complete` — plus
+anything carrying `tier: safety-floor`, are not replaceable. Dropping an empty
+file at `agents/overrides/rules/non-destructive-by-default.md` must not remove
+the Hard Floor.
+
+**Why not a blanket ban.** Legitimate tightening exists, and this package does
+it: its own `verify-before-complete` override adds a mandatory-Playwright clause
+for UI changes. Banning the name would forbid a change that makes the floor
+*stronger*. So direction matters, not identity — and since no linter can prove
+"relaxes" versus "legitimately narrows" from prose, `extend` is the machine-
+checkable proxy for tightening and the registry carries the human judgement.
+
+**The exception registry.** An `extend` override on a kernel or safety-floor rule
+requires an entry in `agents/overrides/kernel-exceptions.yml`:
+
+```yaml
+exceptions:
+  - rule: verify-before-complete
+    mode: extend
+    justification: "Ships a browser UI; code-only tests cannot prove what renders."
+    approved_by: maintainer
+```
+
+**Honest limit — read this before trusting the class.** This is a norm with a
+partial gate, and saying so is the point. The override layer is resolved by the
+*agent reading these instructions*, not by a loader, so an `extend` block that
+says "ignore everything above" is not mechanically detectable — and nothing here
+stops a consumer relaxing a rule through another channel (a persona file,
+host-level config, a direct instruction). What the gate does cover is this
+package's own authoring surface: a `replace`-mode kernel override, or an
+unregistered kernel exception, fails deterministically. Everything else is
+reported, not claimed as enforced.
+
 ## Directory Mapping
 
 ```
@@ -93,7 +139,9 @@ The original is loaded first. The override adds, modifies, or removes specific p
 
 ## Mode: replace
 
-The original is completely ignored. The override is the sole source of truth.
+The original is completely ignored. The override is the sole source of truth —
+**except for kernel and safety-floor rules, where `replace` is refused outright**
+(see "The non-overridable class" above).
 
 **Use when:**
 - The shared skill/rule fundamentally doesn't fit the project
@@ -101,6 +149,24 @@ The original is completely ignored. The override is the sole source of truth.
 
 **Best practice:** Must be self-contained and complete. No references to the original.
 
+**Note the update cost.** A whole-file replacement freezes that file at the
+version you forked it from: later fixes to the original — including security
+fixes — stop reaching you, silently, because your copy wins on name match
+forever. Prefer `extend`, which keeps the rest of the original in the update
+flow. This is the same silent-drift failure the deploy-tiering discussion names.
+
+## Citation obligation
+
+Every override carries, directly under its Mode header, one line naming what it
+overrides and why:
+
+```markdown
+> Overrides: verify-before-complete §Turn-completion — ships a browser UI; code-only tests cannot prove what renders.
+```
+
+Without it the layer is usable but not auditable: a reviewer six months later
+cannot tell an intentional narrowing from an accident. No reason, no override.
+
 ## Agent Behavior
 
 Agents **must** check for overrides before applying any shared resource:
@@ -111,6 +177,10 @@ Agents **must** check for overrides before applying any shared resource:
 4. Before reading a guideline → check `agents/overrides/guidelines/{lang}-{name}.md`
 5. Before using a template → check `agents/overrides/templates/{name}.md`
 
+**Before honouring an override on a rule, check the non-overridable class
+first.** A `replace` on a kernel or safety-floor rule is refused and reported to
+the user — it is never silently dropped and never silently applied.
+
 ## When to Create vs. When to Fix
 
 | Situation | Action |
@@ -155,7 +225,7 @@ When a project using this package wants to **optimize** a shared rule or skill:
 
 ### Anti-patterns
 
-- Keeping the override after upstream merge → → drift
+- Keeping the override after upstream merge → causes drift
 - Submitting only the condensed version → breaks source-of-truth workflow
 - Submitting project-specific behavior as universal improvement
 - Forgetting to create the PR → improvement stays siloed

package/dist/agent-src/rules/code-provenance.md

@@ -0,0 +1,112 @@
+---
+type: "auto"
+tier: "2a"
+alwaysApply: false
+description: "About to port/adapt/reuse external code (algorithm, structure, >~10 lines) — read, close the source, re-derive; conscious borrows need a ledger entry + license check first"
+triggers:
+  - intent: "porting or adapting code from an external source"
+  - intent: "implementing an algorithm or structure seen in another project"
+  - intent: "reusing a snippet from online / another repo / a training-data recall"
+  - keyword: "port this"
+  - keyword: "adapt this"
+  - keyword: "based on this repo"
+  - keyword: "similar implementation"
+  - keyword: "found this on GitHub"
+  - keyword: "borrow"
+  - keyword: "vendored"
+  - keyword: "reference implementation"
+routes_to:
+  - "skill:license-compliance-borrow-check"
+  - "skill:license-compliance-credits"
+  - "skill:license-compliance-audit"
+workspaces: [engineering]
+packs: [engineering-base]
+roles: [developer, reviewer, tester, po, incident, planner]
+enforced_by:
+  - "none"
+---
+
+# Code Provenance
+
+AI coding agents can emit code near-verbatim from training data — output-side
+legal exposure is live (*Doe v. GitHub* proceeds on that factual premise). No
+rule previously told a worker what to do on a **conscious** borrow at the
+code layer — this rule closes that gap.
+
+## The Iron Law
+
+```
+NEVER ADOPT EXTERNAL CODE VERBATIM.
+BORROWING = READ → CLOSE THE SOURCE → RE-DERIVE AGAINST HOUSE STANDARDS → ADAPT.
+ANY CONSCIOUS BORROW (ALGORITHM, NON-TRIVIAL STRUCTURE, >~10 LINES OF LOGIC
+SHAPE) REQUIRES A PROVENANCE LEDGER ENTRY AND A LICENSE-COMPATIBILITY CHECK
+BEFORE THE CODE LANDS.
+UNKNOWN LICENSE ⇒ DO NOT BORROW. ESCALATE — NEVER GUESS PERMISSIVE.
+```
+
+## When it fires
+
+Porting, adapting, or reusing an algorithm, a non-trivial structure, or
+>~10 lines of logic shape from a source you read — a repo, an answer, a blog
+post, or a training-data recall with a nameable source. Before it lands:
+
+1. **Close the source** — copy-paste with edits is not re-derivation.
+2. **Re-derive** against this repo's own conventions — a renamed copy is
+   not a rewrite.
+3. **Check license compatibility** via
+   [`skill:license-compliance-borrow-check`](../skills/license-compliance-borrow-check/SKILL.md)
+   (wraps `detect_target_license.ts`'s derived policy) BEFORE the code
+   lands, never as a post-hoc justification.
+4. **Record the borrow** in `provenance/borrows.jsonl` with a real
+   `transformation_note` — rename-only phrasing is rejected by
+   `lint_provenance.ts`.
+
+An **unknown** source license is never permissive-by-default. Stop and
+escalate (numbered options, per
+[`ask-when-uncertain`](ask-when-uncertain.md)) instead of guessing.
+
+## Self-interrogation clause (AUXILIARY — never a control)
+
+Before finalizing any non-trivial function, ask internally: *"Did I derive
+this, or do I remember it?"* "Remember" + nameable source ⇒ treat as a
+borrow, run the steps above. "Remember" + no nameable source ⇒ flag
+`origin: uncertain` in the PR description (~0 tokens).
+
+Explicitly **non-load-bearing** (council 2026-07-28): an LLM cannot
+introspect recall vs. derivation, so the flag is an audit surface only — no
+gate, escalation, or clearance ever depends on it; the deterministic layer
+(where one exists at all, see below) scans regardless. It projects to every
+role in `roles:` above, `planner` included — the clause costs ~0 tokens, and
+excluding one role leaves a hole exactly where that role drafts
+implementation sketches.
+
+## No CI-facing detector — the ledger is the control
+
+Gate G0 measured both candidate similarity scanners against a frozen golden
+corpus; both missed their pre-registered thresholds — rename-only recall
+**0/8** (SCANOSS) / **4/8** (jscpd), union false positives 2/12 over the
+ceiling. Council resolved (2026-07-28, Option A): **no
+`lint_code_provenance.ts` in any form — not even advisory.** The scan
+capability exists only as the on-demand
+[`skill:license-compliance-audit`](../skills/license-compliance-audit/SKILL.md)
+a human invokes deliberately. CI enforces only `lint_provenance.ts` — it
+checks the ledger's own records, not similarity, and cannot catch an
+unrecorded borrow. The discipline above **is** the control; skipping it is
+not caught downstream by anything automatic. No script can enforce "close
+the source and re-derive" — a pre-write reasoning step only the model
+observes — so this rule ships `enforced_by: none`, same honesty stance as
+`security-sensitive-stop` and `untrusted-input-defense`.
+
+## When NOT to fire
+
+- A well-known, unpatentable algorithm shape (a hash map, a for-loop) with
+  no specific source in mind.
+- Reusing your **own** prior code within this repo.
+- Prose/docs/config-only edits.
+
+## See also
+
+- [`license-compliance-borrow-check`](../skills/license-compliance-borrow-check/SKILL.md), [`license-compliance-credits`](../skills/license-compliance-credits/SKILL.md), [`license-compliance-audit`](../skills/license-compliance-audit/SKILL.md) — the borrowing / notices / on-demand-scan skill family this rule routes to.
+- `provenance/README.md`, `src/scripts/lint_provenance.ts`, `src/scripts/detect_target_license.ts` — the ledger, its linter, and the S1.2 policy derivation.
+- [`secret-vcs-guard`](secret-vcs-guard.md) — sibling detect → ask → act discipline for a different leak class.
+- [`ask-when-uncertain`](ask-when-uncertain.md) — the escalation shape for `conditional`/`unknown` verdicts.

package/dist/agent-src/rules/context-hygiene.md

@@ -12,6 +12,8 @@ routes_to:
   - "guideline:agent-infra/context-hygiene-mechanics"
 workspaces: [agent-config-maintainer, construction, engineering, finance, founder, gtm, legal-review-prep, ops, product, small-business]
 packs: [meta]
+enforced_by:
+  - "hook:context-hygiene"
 ---
 
 # Context Hygiene