@event4u/agent-config 9.7.0 → 9.9.0

package/dist/agent-src/skills/license-compliance-borrow-check/SKILL.md

@@ -0,0 +1,145 @@
+---
+model_tier: medium
+name: license-compliance-borrow-check
+description: "Paste a URL/snippet before you borrow it — detects its license, runs the derived compatibility policy, and drafts a provenance ledger entry — even before any code is written, not after"
+domain: engineering
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+---
+
+# license-compliance-borrow-check
+
+## When to use
+
+- Before adapting, porting, or otherwise consciously reusing an algorithm,
+  a non-trivial structure, or more than roughly ten lines of logic shape
+  from a source you can name (a repo, a gist, a Stack Overflow answer).
+- The [`code-provenance`](../../rules/code-provenance.md) rule fired and its
+  step 3 ("check license compatibility") needs a concrete answer.
+- A reviewer or the `origin: uncertain` self-flag surfaces a borrow that was
+  never checked.
+
+Do NOT use when:
+
+- No conscious borrow happened — a well-known, unpatentable algorithm shape
+  (a for-loop, a hash map) implemented with no specific source in mind.
+- The borrow is already ledgered with a valid entry — use
+  [`license-compliance-credits`](../license-compliance-credits/SKILL.md) to
+  regenerate notices instead.
+- You want a broad similarity scan across the repo, not one source — use
+  [`license-compliance-audit`](../license-compliance-audit/SKILL.md).
+
+## A passing verdict is not a copying clearance
+
+This skill answers ONE question: is the source's license compatible with
+this repo's license, under the derived compatibility policy? An `allow`
+verdict means the license permits the reuse — it says nothing about whether
+the [`code-provenance`](../../rules/code-provenance.md) discipline (read,
+close the source, re-derive against house standards) was actually followed.
+License-clean code that is still a verbatim copy is still a violation of
+that rule. Run both checks; treat neither as a substitute for the other.
+
+## Procedure
+
+1. **Identify the source** — the URL or repo path being borrowed from, and
+   the exact commit or blob SHA the snippet was taken from (`git log -1
+   --format=%H -- <path>` on the source repo, or the URL's own commit ref).
+2. **Detect the source's license.** Check, in order: a `LICENSE`/
+   `LICENSE.md`/`COPYING` file at the source repo root; the source's
+   `package.json` `"license"` field; its `composer.json` `"license"` field;
+   an SPDX header comment in the file itself. If none resolve to a known
+   SPDX id, the license is `unknown` — never guess permissive.
+3. **Detect this repo's target policy.** Run:
+   ```bash
+   npx tsx node_modules/@event4u/agent-config/src/scripts/detect_target_license.ts . --json
+   ```
+   If `license-policy.yaml` exists at the repo root, read its
+   `policy.{allow,conditional,deny}` buckets directly. If it doesn't (dry
+   run only), derive the same buckets by hand from this repo's own
+   `LICENSE` file and the compatibility matrix in
+   `node_modules/@event4u/agent-config/src/scripts/_lib/detect_target_license.ts`
+   (`COMPATIBILITY_MATRIX`/`classifyBorrow`).
+4. **Classify the borrow.** Map the source's SPDX id to its source class
+   (permissive / weak-copyleft / gpl-2.0 / gpl-3.0 / agpl / sspl /
+   `unknown`), then read the verdict off the target's policy buckets:
+   `allow`, `conditional` (escalate), or `deny`. A source license of
+   `unknown` is **always** `deny` — no exception.
+5. **Act on the verdict:**
+   - `allow` → continue to step 6 (draft the ledger entry).
+   - `conditional` → STOP. Don't write the borrowed code yet. Escalate to
+     the user with the exact matrix cell that triggered it (per
+     [`ask-when-uncertain`](../../rules/ask-when-uncertain.md)) — never
+     auto-clear a conditional verdict.
+   - `deny` → refuse the borrow. Name the alternative: write it from
+     scratch, find a permissively-licensed equivalent, or ask the
+     maintainer for an explicit, recorded exception.
+6. **Draft the ledger entry** — one JSON object matching
+   `node_modules/@event4u/agent-config/src/scripts/schemas/provenance-borrow.schema.json` (`source_url`,
+   `license`, `source_sha`, `borrowed_at`, `files`, `transformation_note`,
+   `cleared_by`). Write a `transformation_note` that names a real
+   structural change — rename-only phrasing (e.g. "renamed variables",
+   "cosmetic rename") is rejected by `lint_provenance.ts` even if the code
+   hasn't landed yet, so draft it honestly against what will actually
+   change.
+7. **Present the draft to the user before appending it.** Once the
+   re-derived code lands, append the confirmed entry to
+   `provenance/borrows.jsonl` and verify:
+   ```bash
+   npx tsx node_modules/@event4u/agent-config/src/scripts/lint_provenance.ts
+   ```
+   Exit 0 confirms the entry is schema-valid, license-compliant, and its
+   transformation note passed the rename-only phrase check.
+
+## Output format
+
+1. The classification verdict (`allow` / `conditional` / `deny`) with the
+   exact source class → target class cell that produced it, and the source
+   license's SPDX id (or `unknown`).
+2. The draft ledger entry as a fenced JSON block, ready to append verbatim
+   once the user confirms it.
+3. For `conditional` or `deny`, the specific escalation question or refusal
+   reason presented to the user — never a silently auto-resolved verdict.
+
+## Gotcha
+
+- **`allow` is not a copying clearance** — see the section above; run
+  `code-provenance`'s read-close-re-derive discipline regardless of the
+  license verdict.
+- **No `LICENSE` file at the source is not "no license, so it's free"** — an
+  absent license file defaults to strictest (`unknown` → `deny`), not to
+  permissive.
+- **A `conditional` verdict is not a soft "probably fine"** — it is a hard
+  stop pending human escalation; treating it as advisory is the exact
+  Q1 workspace-license failure mode the roadmap's council resolved against.
+- **`license-policy.yaml` missing does not mean skip the check** — derive
+  the policy by hand from the matrix; a missing policy file is a detection
+  gap, not a green light.
+
+## Do NOT
+
+- NEVER append a ledger entry without presenting the draft to the user
+  first.
+- NEVER treat an undetectable license as permissive — `unknown` fails the
+  linter outright and must escalate.
+- NEVER let a `conditional` verdict proceed without the escalation actually
+  happening this turn.
+- NEVER write a `transformation_note` that only describes a rename or
+  formatting change — describe the real structural change, or don't borrow.
+
+## See also
+
+- [`code-provenance`](../../rules/code-provenance.md) — the rule this skill
+  answers step 3 of.
+- [`license-compliance-credits`](../license-compliance-credits/SKILL.md) —
+  regenerates `docs/THIRD-PARTY-NOTICES.md` once the entry lands.
+- [`license-compliance-audit`](../license-compliance-audit/SKILL.md) — the
+  on-demand similarity scan for suspicious diffs, not for a single known
+  source.
+- `node_modules/@event4u/agent-config/src/scripts/detect_target_license.ts`, `node_modules/@event4u/agent-config/src/scripts/_lib/detect_target_license.ts` — the license-policy derivation this skill consumes.
+- `node_modules/@event4u/agent-config/src/scripts/lint_provenance.ts`, `provenance/README.md`,
+  `node_modules/@event4u/agent-config/src/scripts/schemas/provenance-borrow.schema.json` — the ledger + its
+  contract.
+- [`ask-when-uncertain`](../../rules/ask-when-uncertain.md) — the escalation
+  shape for `conditional`/`unknown` verdicts.

package/dist/agent-src/skills/license-compliance-borrow-check/evals/triggers.json

@@ -0,0 +1,52 @@
+{
+    "skill": "license-compliance-borrow-check",
+    "last_eval": "2026-07-28",
+    "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers pasting a source URL/repo to check its license before borrowing, and asking whether a specific borrow is allowed. Should-not-trigger covers near-miss neighbours (regenerating notices, running a broad similarity scan, generic new-dependency intake, plain code review) whose vocabulary overlaps.",
+    "queries": [
+        {
+            "q": "I want to adapt this retry-loop from https://github.com/example/repo — is its license compatible with ours?",
+            "trigger": true
+        },
+        {
+            "q": "this Stack Overflow answer has the algorithm I need, check if I can use it before I write the code",
+            "trigger": true
+        },
+        {
+            "q": "can I borrow this LRU cache implementation, it's under GPL-3.0?",
+            "trigger": true
+        },
+        {
+            "q": "draft a ledger entry for the debounce helper I ported from another repo",
+            "trigger": true
+        },
+        {
+            "q": "what license does this vendored snippet carry and does it clear our policy?",
+            "trigger": true
+        },
+        {
+            "q": "regenerate the third-party notices file, the ledger just changed",
+            "trigger": false,
+            "note": "notices regeneration → license-compliance-credits"
+        },
+        {
+            "q": "run a similarity scan across the whole diff to check for copied code",
+            "trigger": false,
+            "note": "broad corpus scan, no single named source → license-compliance-audit"
+        },
+        {
+            "q": "add lodash to package.json and install it",
+            "trigger": false,
+            "note": "new dependency intake, not a code borrow → supply-chain-intake"
+        },
+        {
+            "q": "review this diff for correctness and style issues",
+            "trigger": false,
+            "note": "generic code review, no borrow involved"
+        },
+        {
+            "q": "what CVEs affect the version of this package we're pinned to?",
+            "trigger": false,
+            "note": "dependency vulnerability scanning, not licensing a borrow"
+        }
+    ]
+}

package/dist/agent-src/skills/license-compliance-credits/SKILL.md

@@ -0,0 +1,97 @@
+---
+model_tier: lite
+name: license-compliance-credits
+description: "Regenerate docs/THIRD-PARTY-NOTICES.md from provenance/borrows.jsonl after any ledger change — even a single new entry — never hand-edit the notices file"
+domain: engineering
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+---
+
+# license-compliance-credits
+
+## When to use
+
+- `provenance/borrows.jsonl` just gained, lost, or changed a line (a new
+  borrow was ledgered via
+  [`license-compliance-borrow-check`](../license-compliance-borrow-check/SKILL.md),
+  or a correction line was appended).
+- `npx tsx node_modules/@event4u/agent-config/src/scripts/lint_provenance.ts`
+  reports the notices file is out of sync with the ledger.
+- Someone asks "are our third-party notices up to date?" or "regenerate the
+  credits file".
+
+Do NOT use when:
+
+- You want to add a NEW borrow — that starts at
+  [`license-compliance-borrow-check`](../license-compliance-borrow-check/SKILL.md);
+  this skill only regenerates the derived file from an already-updated
+  ledger.
+- The ledger itself needs fixing (a deny-class entry, a missing note) — fix
+  the offending line via `license-compliance-borrow-check`'s discipline
+  first; this skill cannot repair a bad ledger, only render it.
+
+## Procedure
+
+1. **Inspect the current state** — read `provenance/borrows.jsonl` (may be
+   legitimately empty) and note its line count before regenerating, so the
+   diff is checkable.
+2. **Regenerate the notices file:**
+   ```bash
+   npx tsx node_modules/@event4u/agent-config/src/scripts/lint_provenance.ts --regenerate-notices
+   ```
+3. **Diff `docs/THIRD-PARTY-NOTICES.md`** before vs. after — confirm only
+   that generated file changed, and that `provenance/borrows.jsonl` itself
+   was not touched (it's append-only; this command never writes to it).
+4. **Verify sync + validity** with a plain run (no flag):
+   ```bash
+   npx tsx node_modules/@event4u/agent-config/src/scripts/lint_provenance.ts
+   ```
+   Exit code 0 confirms every ledger record is schema-valid, no deny-class
+   or `unknown` license slipped through, no transformation note reads as
+   rename-only, and the notices file now matches the ledger byte-for-byte.
+5. **If the linter fails**, stop — do not hand-patch
+   `docs/THIRD-PARTY-NOTICES.md` to make it pass. Fix the actual offending
+   line in `provenance/borrows.jsonl` via
+   [`license-compliance-borrow-check`](../license-compliance-borrow-check/SKILL.md),
+   then re-run step 2.
+
+## Output format
+
+1. The regenerate command's exit status and a one-line summary of what
+   changed in the notices file (e.g. "added 1 entry: `<source_url>`
+   (`<license>`)", or "no borrows recorded" for the honest empty-ledger
+   state).
+2. The follow-up `lint_provenance` (no flag) exit code, confirming sync —
+   never report success on the regenerate step alone.
+
+## Gotcha
+
+- **`docs/THIRD-PARTY-NOTICES.md` is generated** — a hand-edit is invisible
+  until the next `lint_provenance` run flags the drift as a linter failure,
+  not as an obvious diff. Always regenerate; never patch the file directly.
+- **An empty ledger is the honest starting state, not a bug** — it renders a
+  plain "no borrows recorded" line. Do not "fix" that by adding a
+  placeholder entry.
+- **This skill cannot make a bad ledger pass** — if `lint_provenance`
+  (no flag) still fails after regenerating, the defect is in
+  `provenance/borrows.jsonl`, not in the notices file.
+
+## Do NOT
+
+- NEVER hand-edit `docs/THIRD-PARTY-NOTICES.md`.
+- NEVER skip the post-regenerate `lint_provenance` (no-flag) run —
+  regeneration and validation are two different checks; passing one does
+  not imply the other passed.
+- NEVER add or edit a line in `provenance/borrows.jsonl` from this skill —
+  that belongs to `license-compliance-borrow-check`.
+
+## See also
+
+- [`code-provenance`](../../rules/code-provenance.md) — the rule that makes
+  a ledger entry mandatory before a conscious borrow lands.
+- [`license-compliance-borrow-check`](../license-compliance-borrow-check/SKILL.md) —
+  where new ledger entries are drafted and fixed.
+- `provenance/README.md` — the ledger's append-only contract.
+- `node_modules/@event4u/agent-config/src/scripts/lint_provenance.ts` — the linter this skill wraps.

package/dist/agent-src/skills/license-compliance-credits/evals/triggers.json

@@ -0,0 +1,52 @@
+{
+    "skill": "license-compliance-credits",
+    "last_eval": "2026-07-28",
+    "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers regenerating THIRD-PARTY-NOTICES.md after a ledger change, and asking whether notices are in sync. Should-not-trigger covers near-miss neighbours (drafting a new ledger entry, running a similarity scan, generic changelog/readme updates) whose vocabulary overlaps.",
+    "queries": [
+        {
+            "q": "the borrows ledger just got a new entry, regenerate the notices file",
+            "trigger": true
+        },
+        {
+            "q": "are our third-party notices up to date with provenance/borrows.jsonl?",
+            "trigger": true
+        },
+        {
+            "q": "lint_provenance says NOTICES.md is out of sync, fix that",
+            "trigger": true
+        },
+        {
+            "q": "regenerate the credits file from the ledger",
+            "trigger": true
+        },
+        {
+            "q": "rebuild THIRD-PARTY-NOTICES.md after I appended to borrows.jsonl",
+            "trigger": true
+        },
+        {
+            "q": "draft a new ledger entry for this snippet I want to borrow from an MIT repo",
+            "trigger": false,
+            "note": "new borrow drafting → license-compliance-borrow-check"
+        },
+        {
+            "q": "scan this diff for copied code against known OSS",
+            "trigger": false,
+            "note": "similarity scan → license-compliance-audit"
+        },
+        {
+            "q": "update the CHANGELOG for this release",
+            "trigger": false,
+            "note": "unrelated generated doc, not the provenance ledger"
+        },
+        {
+            "q": "add a new section to the README about installation",
+            "trigger": false,
+            "note": "generic README editing, no ledger involved"
+        },
+        {
+            "q": "check whether this dependency's license is compatible with GPL",
+            "trigger": false,
+            "note": "license compatibility check on a new dep, not notices regeneration"
+        }
+    ]
+}

package/dist/agent-src/skills/md-language-check/SKILL.md

@@ -23,7 +23,7 @@ packs:
 
 Fire this skill **before** writing or saving any `.md` file under:
 
-- `.agent-src.uncondensed/` (source of truth — skills, rules, commands, guidelines, templates, contexts)
+- `src/` (source of truth — skills, rules, commands, guidelines, templates, contexts)
 - `dist/agent-src/` (condensed projection)
 - `.augment/` (local agent projection)
 - `agents/` (project-specific roadmaps, contexts, sessions)

package/dist/agent-src/skills/override-management/SKILL.md

@@ -20,7 +20,7 @@ packs:
 Use when creating or managing project-level overrides for shared skills, rules, commands, or guidelines — customizing `.augment/` content without modifying originals.
 
 Do NOT use when:
-- Changing shared content that should affect all projects (edit `.agent-src.uncondensed/` directly)
+- Changing shared content that should affect all projects (edit `src/` directly)
 - Creating new skills from scratch (use `skill-writing` skill)
 
 ## Purpose

package/dist/agent-src/skills/prediction-pool-optimizer/SKILL.md

@@ -145,9 +145,9 @@ Don't hand-pick a scoreline. Run the executed grid optimiser — builds the full
 Poisson score grid, returns the EV-max tip under the step-1 point tiers:
 
 ```bash
-./scripts-run src/scripts/prediction-pool/score_ev --lh <home-xg> --la <away-xg> \
+npx tsx node_modules/@event4u/agent-config/src/scripts/prediction-pool/score_ev.ts --lh <home-xg> --la <away-xg> \
     --tendency <t> --diff <d> --exact <e>          # one match
-./scripts-run src/scripts/prediction-pool/score_ev matches.json \
+npx tsx node_modules/@event4u/agent-config/src/scripts/prediction-pool/score_ev.ts matches.json \
     --tendency <t> --diff <d> --exact <e>          # batch, prints a ranked table
 ```
 
@@ -176,7 +176,7 @@ of the field)**; pure EV-max converges with the crowd, can't open a gap.
 Measure it with the executed field simulator, not a "rough Kelly" hand-wave:
 
 ```bash
-./scripts-run src/scripts/prediction-pool/pool_winsim pool.json --runs 4000 --max-flips 4
+npx tsx node_modules/@event4u/agent-config/src/scripts/prediction-pool/pool_winsim.ts pool.json --runs 4000 --max-flips 4
 ```
 
 Models the field as softmax-EV tippers, reports `P(win)` for EV-max-everywhere,
@@ -204,7 +204,7 @@ question type — full taxonomy + per-type method in
   winner") aggregated per step 2, **or** the executed Poisson simulator:
 
   ```bash
-  ./scripts-run src/scripts/prediction-pool/poisson_sim <teams-xg.json> --runs 20000
+  npx tsx node_modules/@event4u/agent-config/src/scripts/prediction-pool/poisson_sim.ts <teams-xg.json> --runs 20000
   ```
 
   It plays the bracket from per-team expected goals and prints empirical
@@ -306,9 +306,9 @@ gate — the skill never enters or submits anything.
   question taxonomy with a per-type method.
 - [`reference/ev-fixtures.md`](reference/ev-fixtures.md) — known-good
   rules+odds → EV examples.
-- [`scripts/prediction-pool/score_ev.ts`](../../../../scripts/prediction-pool/score_ev.ts) —
+- `node_modules/@event4u/agent-config/src/scripts/prediction-pool/score_ev.ts` —
   executed exact-score EV optimiser (step 4a; λ + rule → EV-max scoreline).
-- [`scripts/prediction-pool/pool_winsim.ts`](../../../../scripts/prediction-pool/pool_winsim.ts) —
+- `node_modules/@event4u/agent-config/src/scripts/prediction-pool/pool_winsim.ts` —
   executed field model + P(finish 1st) simulator and flip-finder (step 4b).
-- [`scripts/prediction-pool/poisson_sim.ts`](../../../../scripts/prediction-pool/poisson_sim.ts) —
+- `node_modules/@event4u/agent-config/src/scripts/prediction-pool/poisson_sim.ts` —
   the executed tournament simulator (step 5).

package/dist/agent-src/skills/project-analysis-core/SKILL.md

@@ -138,7 +138,7 @@ analysis output — applies to every `project-analysis-*` specialist
 this skill hands off to:
 
 ```bash
-./scripts-run src/scripts/emit_knowledge_event --type convention_detected \
+npx tsx node_modules/@event4u/agent-config/src/scripts/emit_knowledge_event.ts --type convention_detected \
     --pattern "<pattern>" --evidence "file:line" --sample-size <N> --scope project
 ```
 

package/dist/agent-src/skills/prompt-engineering-image/SKILL.md

@@ -70,7 +70,8 @@ has distinct prompt grammar — this skill applies the right structure per adapt
 3. **Apply provider grammar** from the section above for the target model.
 4. **Tune for the job shape** — text-literal first for Ideogram; noun-phrase first for Flux;
    minimal + `style:` param for Recraft; natural language for Gemini/GPT.
-5. **Inspect the adapter header** — open `src/scripts/ai-image/adapters/<provider>.sh`
+5. **Inspect the adapter header** — open
+   `node_modules/@event4u/agent-config/src/scripts/ai-image/adapters/<provider>.sh`
    and confirm the param enums (aspect/style/model) the prompt relies on still match.
 6. **Emit the prompt** in the Output format below.
 
@@ -111,5 +112,5 @@ descriptors will be ignored and the vector output will be wrong.
 
 - [`image-provider-routing`](../image-provider-routing/SKILL.md) — select the provider before writing the prompt.
 - [`provider-lifecycle-discipline`](../../rules/provider-lifecycle-discipline.md) — lifecycle tier gates live runs.
-- `src/scripts/ai-image/adapters/` — adapter header comments for param enums.
+- `node_modules/@event4u/agent-config/src/scripts/ai-image/adapters/` — adapter header comments for param enums.
 - [`image-likeness-and-rights`](../../rules/image-likeness-and-rights.md) — rights check before generating real-person likenesses or brand marks.

package/dist/agent-src/skills/react-shadcn-ui/SKILL.md

@@ -100,8 +100,8 @@ Do NOT use when:
   [`docs/guidelines/design-antipatterns.md`](../../../docs/guidelines/design-antipatterns.md)
   before the polish step (Visual V1–V7, Layout L1–L8 are the React-component
   slop tells); the objective quality floors (WCAG contrast, focus-visible,
-  reduced-motion) are CI-enforced by
-  [`lint_design_quality`](../../../src/scripts/lint_design_quality.ts).
+  reduced-motion) are validated via `accessibility-auditor`'s checklist —
+  cite its verdict rather than eyeballing.
 
 ## Covered primitives
 

package/dist/agent-src/skills/readme-writing/SKILL.md

@@ -226,7 +226,12 @@ to every README you author.
 1. Does the opening paragraph carry marketing adjectives ("modern",
    "comprehensive", "powerful")?
 2. Are setup steps narrated instead of bulleted commands?
-3. Are screenshots / GIFs present without explicit user request?
+3. Are screenshots / GIFs present without explicit user request? A
+   **data-bearing** screenshot (dashboard, admin panel, form/list with real
+   content) without an explicit request is a stronger flag — route it through
+   [`screenshot-hygiene`](../screenshot-hygiene/SKILL.md): anonymize sensitive
+   data and human-gate the embed before it ships. Illustrative / no-data visuals
+   (diagrams, placeholder-only UI) are the reconciled exception.
 4. Is content duplicated from `AGENTS.md` rather than linked?
 
 ## Do NOT

package/dist/agent-src/skills/recursive-verification/SKILL.md

@@ -41,6 +41,12 @@ Land a verified result by running a depth-bounded
 the only compute knob, every level budgeted, and the loop default-off
 until a benchmark gate authorises it per host.
 
+> **Disposition (2026-07-28, honest null — TERMINAL).** Recursive-verification
+> benchmark resolved as published null (no measured lift over single-pass
+> verification; see `docs/benchmark.md`). `verification.recursive` stays
+> default-off bound to that null; removal at next major unless external
+> evidence appears first. NOT sold as a quality-lift mechanism.
+
 ## The Iron Law
 
 ```

package/dist/agent-src/skills/refine-ticket/SKILL.md

@@ -182,9 +182,9 @@ naming (e.g. `feat/` vs `fix/` vs `refactor/` prefix), and
 risks instead of inventing terms.
 
 The match lists and `require_count` thresholds are owned by
-`detection-map.yml` — edit the map, not this skill. Tests:
-[`tests/scripts/refine_ticket_detect.test.ts`](../../../tests/scripts/refine_ticket_detect.test.ts)
-(DE + EN fixtures, repo-aware + graceful-degrade coverage).
+`detection-map.yml` — edit the map, not this skill (DE + EN fixtures,
+repo-aware + graceful-degrade coverage are regression-locked in this
+package's own test suite).
 
 ### 3. Orchestrate
 

package/dist/agent-src/skills/roadmap-writing/SKILL.md

@@ -301,6 +301,10 @@ to every roadmap you author.
    behind the scope? `## Provenance` block with `ENC1:` link? inlined
    council convergence? anti-dump acceptance criterion? (Internally
    originated → these must be **absent**, not empty.)
+8. *Inbox-sourced only:* roadmap consumed an `agents/tmp/` file as input →
+   file moved to `agents/tmp.old/<name>` in the SAME reply, Source line
+   pointing at the `tmp.old/` path? (Per `agents-layout § User Inbox
+   Workflow`. Move only the named input file(s); never sweep the inbox.)
 
 ## Do NOT
 

package/dist/agent-src/skills/rtk-output-filtering/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: medium
 name: rtk-output-filtering
-description: "Use when running verbose CLI commands — wraps them with rtk (Rust Token Killer) for 60-90% token savings. Covers installation, configuration, and usage patterns."
+description: "Use when running verbose CLI commands — wraps them with rtk (Rust Token Killer, third-party Apache-2.0; upstream reports 60-90% token savings). Covers installation, configuration, and usage patterns."
 domain: process
 execution:
   type: assisted
@@ -23,9 +23,17 @@ packs:
 
 ## What
 
-High-performance CLI proxy that reduces LLM token consumption by 60-90%
-on common dev commands through intelligent output filtering (whitespace, boilerplate,
+High-performance CLI proxy that reduces LLM token consumption on common dev
+commands through intelligent output filtering (whitespace, boilerplate,
 comments, duplicate log messages). Single Rust binary, <10ms startup overhead.
+**Third-party Apache-2.0 tool** (rtk-ai upstream — an external project, not part of this package).
+
+**Savings, honestly stated:** upstream reports 60-90% (their estimate —
+"actual savings vary"). agent-config's own scoped spot-measurement
+(2026-07-28, one repo, one macOS machine, 8-command corpus) landed at
+**33% overall, 0-57% per command** — verbose commands (`git status`,
+`git log`, `ls -la`) save ~55%, already-compact output (`--oneline`,
+`--stat`) passes through at ~0%. See `internal/bench/rtk-savings/RESULTS.md`.
 
 **Docs:** https://www.mintlify.com/rtk-ai/rtk
 **Repo:** https://github.com/rtk-ai/rtk
@@ -34,9 +42,9 @@ comments, duplicate log messages). Single Rust binary, <10ms startup overhead.
 
 Wrap any CLI command with `rtk`:
 ```bash
-rtk git status        # 80-92% savings
-rtk git log           # compact log output
-rtk cargo test        # 90% savings — only failures shown
+rtk git status        # verbose status → compact (measured ~55% here)
+rtk git log           # compact log output (measured ~55% here)
+rtk cargo test        # upstream: only failures shown
 rtk npm test          # same for JS/TS
 rtk docker compose ps # compact container status
 ```
@@ -70,12 +78,23 @@ outside onboarding, follow the Installation section below and set
 
 ## Installation (on-demand)
 
-Invoked by `/onboard` when rtk is not on `PATH`, or on explicit user
-request. Never fire unsolicited.
-
-1. Ask which installer to use (macOS → Homebrew; otherwise Cargo).
-2. Run the installer. On success:
-   1. `rtk --version` to verify.
+Invoked when rtk is not on `PATH` and the user explicitly asks to install
+it. Never fire unsolicited.
+
+1. Offer the verified per-OS install path (same map as
+   `src/install/rtkDetection.ts` / `docs/contracts/rtk-detection.md`):
+   - macOS → `brew install rtk` (official homebrew-core formula)
+   - Linux → `curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/master/install.sh | sh`
+     (installs to `~/.local/bin`)
+   - Windows → `winget install rtk-ai.rtk` (plus the documented ripgrep
+     dependency: `winget install BurntSushi.ripgrep.MSVC`); winget-less
+     images use the upstream `rtk-x86_64-pc-windows-msvc.zip` release.
+   **NEVER `cargo install rtk`** — the bare crates.io `rtk` crate is the
+   unrelated Rust Type Kit, not Rust Token Killer.
+2. Run the installer only on explicit confirmation. On success:
+   1. `rtk gain` to verify IDENTITY (the savings dashboard prints "RTK
+      Token Savings" only on Rust Token Killer — `rtk --version` cannot
+      distinguish the two same-name tools).
    2. `rtk init --global` to enable auto-rewrite hooks.
    3. Apply **Post-Install Setup** below (telemetry, tee, audit logging).
    4. Generate project-local filters (see Post-Install Setup).

package/dist/agent-src/skills/rule-refactor/SKILL.md

@@ -80,13 +80,13 @@ For each approved verdict:
 
 * **merge** → rewrite the surviving rule to cover both domains;
   delete the absorbed one; update any `routes_to:` references.
-* **delete** → remove the file from `.agent-src.uncondensed/rules/`
+* **delete** → remove the file from `src/rules/`
   and the corresponding `dist/agent-src/rules/` projection.
 * **move-to-context** → extract the body into
-  `.agent-src.uncondensed/contexts/<area>/<name>.md`, replace the
+  `src/agent-src/contexts/<area>/<name>.md`, replace the
   rule body with the obligation + a `load_context:` pointer.
 * **promote-to-skill** → create
-  `.agent-src.uncondensed/skills/<name>/SKILL.md`, replace the rule
+  `src/skills/<name>/SKILL.md`, replace the rule
   with an auto-trigger stub that routes to it (or delete the rule
   entirely if the skill's own trigger suffices).