@event4u/agent-config 9.8.0 → 9.10.0

package/dist/agent-src/rules/code-provenance.md

@@ -0,0 +1,112 @@
+---
+type: "auto"
+tier: "2a"
+alwaysApply: false
+description: "Porting/adapting external code (algorithm, structure, >~10 lines) — close the source, re-derive; conscious borrows need a ledger entry + license check"
+triggers:
+  - intent: "porting or adapting code from an external source"
+  - intent: "implementing an algorithm or structure seen in another project"
+  - intent: "reusing a snippet from online / another repo / a training-data recall"
+  - keyword: "port this"
+  - keyword: "adapt this"
+  - keyword: "based on this repo"
+  - keyword: "similar implementation"
+  - keyword: "found this on GitHub"
+  - keyword: "borrow"
+  - keyword: "vendored"
+  - keyword: "reference implementation"
+routes_to:
+  - "skill:license-compliance-borrow-check"
+  - "skill:license-compliance-credits"
+  - "skill:license-compliance-audit"
+workspaces: [engineering]
+packs: [engineering-base]
+roles: [developer, reviewer, tester, po, incident, planner]
+enforced_by:
+  - "none"
+---
+
+# Code Provenance
+
+AI coding agents can emit code near-verbatim from training data — output-side
+legal exposure is live (*Doe v. GitHub* proceeds on that factual premise). No
+rule previously told a worker what to do on a **conscious** borrow at the
+code layer. This rule closes that gap.
+
+## The Iron Law
+
+```
+NEVER ADOPT EXTERNAL CODE VERBATIM.
+BORROWING = READ → CLOSE THE SOURCE → RE-DERIVE AGAINST HOUSE STANDARDS → ADAPT.
+ANY CONSCIOUS BORROW (ALGORITHM, NON-TRIVIAL STRUCTURE, >~10 LINES OF LOGIC
+SHAPE) REQUIRES A PROVENANCE LEDGER ENTRY AND A LICENSE-COMPATIBILITY CHECK
+BEFORE THE CODE LANDS.
+UNKNOWN LICENSE ⇒ DO NOT BORROW. ESCALATE — NEVER GUESS PERMISSIVE.
+```
+
+## When it fires
+
+Porting, adapting, or reusing an algorithm, a non-trivial structure, or
+>~10 lines of logic shape from a source you read — a repo, an answer, a blog
+post, or a training-data recall with a nameable source. Before it lands:
+
+1. **Close the source** — copy-paste with edits is not re-derivation.
+2. **Re-derive** against this repo's own conventions — a renamed copy is
+   not a rewrite.
+3. **Check license compatibility** via
+   [`skill:license-compliance-borrow-check`](../skills/license-compliance-borrow-check/SKILL.md)
+   (wraps `detect_target_license.ts`'s derived policy) BEFORE the code
+   lands, never as a post-hoc justification.
+4. **Record the borrow** in `provenance/borrows.jsonl` with a real
+   `transformation_note` — rename-only phrasing is rejected by
+   `lint_provenance.ts`.
+
+An **unknown** source license is never permissive-by-default. Stop and
+escalate (numbered options, per
+[`ask-when-uncertain`](ask-when-uncertain.md)) instead of guessing.
+
+## Self-interrogation clause (AUXILIARY — never a control)
+
+Before finalizing any non-trivial function, ask internally: *"Did I derive
+this, or do I remember it?"* "Remember" + nameable source ⇒ treat as a
+borrow, run the steps above. "Remember" + no nameable source ⇒ flag
+`origin: uncertain` in the PR description (~0 tokens).
+
+Explicitly **non-load-bearing** (council 2026-07-28): an LLM cannot
+introspect recall vs. derivation, so the flag is an audit surface only — no
+gate, escalation, or clearance ever depends on it; the deterministic layer
+(where one exists at all, see below) scans regardless. It projects to every
+role in `roles:` above, `planner` included — the clause costs ~0 tokens, and
+excluding one role leaves a hole exactly where that role drafts
+implementation sketches.
+
+## No CI-facing detector — the ledger is the control
+
+Gate G0 measured both candidate similarity scanners against a frozen golden
+corpus; both missed their pre-registered thresholds — rename-only recall
+**0/8** (SCANOSS) / **4/8** (jscpd), union false positives 2/12 over the
+ceiling. Council resolved (2026-07-28, Option A): **no
+`lint_code_provenance.ts` in any form — not even advisory.** The scan
+capability exists only as the on-demand
+[`skill:license-compliance-audit`](../skills/license-compliance-audit/SKILL.md)
+a human invokes deliberately. CI enforces only `lint_provenance.ts` — it
+checks the ledger's own records, not similarity, and cannot catch an
+unrecorded borrow. The discipline above **is** the control; skipping it is
+not caught downstream by anything automatic. No script can enforce "close
+the source and re-derive" — a pre-write reasoning step only the model
+observes — so this rule ships `enforced_by: none`, same honesty stance as
+`security-sensitive-stop` and `untrusted-input-defense`.
+
+## When NOT to fire
+
+- A well-known, unpatentable algorithm shape (a hash map, a for-loop) with
+  no specific source in mind.
+- Reusing your **own** prior code within this repo.
+- Prose/docs/config-only edits.
+
+## See also
+
+- [`license-compliance-borrow-check`](../skills/license-compliance-borrow-check/SKILL.md), [`license-compliance-credits`](../skills/license-compliance-credits/SKILL.md), [`license-compliance-audit`](../skills/license-compliance-audit/SKILL.md) — the borrowing / notices / on-demand-scan skill family this rule routes to.
+- `provenance/README.md`, `src/scripts/lint_provenance.ts`, `src/scripts/detect_target_license.ts` — the ledger, its linter, and the S1.2 policy derivation.
+- [`secret-vcs-guard`](secret-vcs-guard.md) — sibling detect → ask → act discipline for a different leak class.
+- [`ask-when-uncertain`](ask-when-uncertain.md) — the escalation shape for `conditional`/`unknown` verdicts.

package/dist/agent-src/rules/commit-policy.md

@@ -29,7 +29,7 @@ Exactly four:
 3. **Commit command invoked** — `/commit` (confirmed) or `/commit:in-chunks` (auto-split).
 4. **Roadmap authorization** — roadmap lists explicit commit steps and the user invoked roadmap execution.
 
-Anything else → no commit. Hard Floor (bulk deletions, infra changes) still fires on top of any exception — see [`commit-mechanics`](../contexts/authority/commit-mechanics.md) for diff triggers and roadmap-authorized commit flow.
+Anything else → no commit. Hard Floor (bulk deletions, infra changes) still fires on top of any exception — diff triggers + roadmap-authorized flow: [`commit-mechanics`](../contexts/authority/commit-mechanics.md).
 
 ## One-shot authorization is not a standing license
 
@@ -39,7 +39,7 @@ IT NEVER BECOMES A STANDING LICENSE FOR LATER COMMITS OR PUSHES.
 EACH FURTHER COMMIT / PUSH NEEDS ITS OWN FRESH, EXPLICIT GO-AHEAD.
 ```
 
-"Commit this", "push it", "open the PR", "create the PRs" authorize **that operation, once** — not the commits/pushes that follow later in the **same** task. "Create the PR" is spent on the initial branch + commit + push + PR; the next change (a follow-up fix, a review response, a quality pass, a "while I'm here" cleanup) waits for a new instruction. A task instruction that only asks for **code** ("fix X", "use file Y for tests", "there's a linter error") authorizes the code change **only** — never a commit or push. Re-using an earlier authorization for a later operation is exactly the inference (exception 2 misread as "standing") this rule forbids.
+"Commit this", "push it", "open the PR", "create the PRs" authorize **that operation, once** — not later commits/pushes in the **same** task. "Create the PR" is spent on the initial branch + commit + push + PR; the next change (follow-up fix, review response, quality pass, "while I'm here" cleanup) waits for a new instruction. A task instruction asking only for **code** ("fix X", "use file Y for tests", "there's a linter error") authorizes the code change **only** — never a commit or push. Re-using an earlier authorization for a later operation is exactly the inference (exception 2 misread as "standing") this rule forbids.
 
 ## NEVER ask about committing
 
@@ -55,13 +55,8 @@ NEVER ASK "ONE COMMIT OR MULTIPLE?", "HOW SHOULD I SPLIT?",
 "WHICH CHUNK FIRST?". THE AGENT PICKS THE SPLIT.
 ```
 
-One chunk per concern, foundation-first; generated files ride with their source. Full mechanics + carve-outs: [`commit-mechanics`](../contexts/authority/commit-mechanics.md).
+One chunk per concern, foundation-first; generated files ride with their source. Mechanics + carve-outs: [`commit-mechanics`](../contexts/authority/commit-mechanics.md).
 
 ## NEVER write commit steps into roadmaps unsolicited
 
-Roadmaps plan **work**, not commits — when creating a roadmap, never add commit steps unless the user explicitly asked. Detail: [`commit-mechanics`](../contexts/authority/commit-mechanics.md).
-
-## See also
-
-- [`scope-control`](scope-control.md) — git-ops permission gate (push, merge, branch, PR, tag).
-- [`no-cheap-questions`](no-cheap-questions.md) — canonical Iron Law. · [`autonomous-execution`](autonomous-execution.md) · [`/commit`](../commands/commit.md) · [`/commit:in-chunks`](../commands/commit/in-chunks.md).
+Roadmaps plan **work**, not commits — never add commit steps to a roadmap unless the user explicitly asked. Detail: [`commit-mechanics`](../contexts/authority/commit-mechanics.md).

package/dist/agent-src/rules/communication-through-line.md

@@ -2,7 +2,7 @@
 type: "auto"
 tier: "2b"
 alwaysApply: false
-description: "Multi-step or continuation replies carry a red thread — state the goal once, tie each turn back to it, name what changed since last turn, close the loop with one end-summary"
+description: "Multi-step or continuation replies carry a red thread — goal once, each turn tied to it, name what changed, close with one end-summary"
 triggers:
   - intent: "producing a multi-step or continuation reply"
   - intent: "reporting progress on ongoing work"
@@ -12,7 +12,7 @@ packs: [meta]
 
 # Communication Through-Line
 
-The user follows the work through your replies. A multi-step task whose replies jump between sub-topics with no visible thread forces the user to re-derive where things stand every turn. Give the work a **red thread**: a followable narrative from goal to result. Session-spanning coherence — distinct from single-reply brevity (`direct-answers`) and option formatting (`user-interaction`), which it never overrides.
+The user follows the work through your replies. A multi-step task whose replies jump between sub-topics with no visible thread forces the user to re-derive where things stand every turn. Give the work a **red thread**: a followable narrative from goal to result. This is session-spanning coherence — distinct from single-reply brevity (`direct-answers`) and option formatting (`user-interaction`), which it never overrides.
 
 ## The Iron Law
 
@@ -24,10 +24,10 @@ CLOSE THE LOOP WITH ONE END-SUMMARY. NEVER MAKE THE USER RE-DERIVE WHERE THINGS
 ## Checkable behaviors
 
 - **Anchor once.** At the start of a multi-step task, state the goal/plan in one line (not re-stated every turn).
-- **Each turn locates itself.** A mid-task reply says, in a few words, where it sits in the plan ("step 3/5", "now the downstream wiring") — so the user never scrolls up to orient.
+- **Each turn locates itself.** A mid-task reply says, in a few words, where it sits in that plan ("step 3/5", "now the downstream wiring") — so the user never has to scroll up to orient.
 - **Name the delta.** On a continuation, say what changed since the last turn (what landed, what's next) rather than restating everything.
-- **Close the loop.** A work reply ends with ONE end-summary mapping back to the stated goal — reached or not, what remains. (Same single end-summary `direct-answers` requires; do not add a second.)
-- **Signal pivots.** If the work changes direction (new sub-task, interrupt, blocker), say so explicitly — a silent topic switch breaks the thread.
+- **Close the loop.** A work reply ends with ONE end-summary that maps back to the stated goal — did we reach it, what remains. (This is the same single end-summary `direct-answers` requires; do not add a second.)
+- **Signal pivots.** If the work changes direction (new sub-task, interrupt, a blocker), say so explicitly — a silent topic switch breaks the thread.
 
 ## When NOT to over-apply
 

package/dist/agent-src/rules/decision-revisit-gate.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2b"
-description: "A beneficial change blocked by a past lock (honest-null, don't-relitigate memory, budget canon, ADR) must be surfaced with a council re-evaluation offer, never silently dropped"
+description: "Beneficial change blocked by a lock (honest-null, don't-relitigate memory, budget canon, ADR) — surface a council re-evaluation offer, never drop"
 alwaysApply: false
 council_depth: deep
 triggers:

package/dist/agent-src/rules/doc-screenshot-hygiene.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "Screenshots for docs — anonymize sensitive data before shipping; data-bearing shots are human-gated (published egress); terminal/CLI/IDE screenshots forbidden"
+description: "Doc screenshots — anonymize sensitive data before shipping; data-bearing shots human-gated (published egress); terminal/CLI/IDE shots forbidden"
 triggers:
   - keyword: "screenshot"
   - keyword: "screenshots"

package/dist/agent-src/rules/domain-adoption-policy.md

@@ -10,7 +10,7 @@ triggers:
   - keyword: "mobile track"
   - keyword: "ml track"
   - keyword: "blockchain track"
-  - path_prefix: ".agent-src.uncondensed/skills/"
+  - path_prefix: "src/skills/"
 validator_ignore:
   - type: "substring"
     pattern: ".agent-src.uncondensed/"

package/dist/agent-src/rules/domain-safety-pii.md

@@ -91,7 +91,7 @@ EVER REACHES THE LOG STREAM. ALLOWLISTED STRUCTURED FIELDS ONLY.
 Required patterns:
 
 1. **Allowlisted structured fields only.** Log `user_id`, `tenant_id`, `request_id`, `event_type` — never `user` or `request` blobs.
-2. **PII-exclusion-by-construction (preferred over redaction).** Make the log/event **type physically incapable** of holding free-form content — struct of allowlisted scalars, no `payload`/`body`/`extra: any`. A type that cannot carry a phone number has no scrubber to fail; redaction (next) is the fallback when a content field is unavoidable.
+2. **PII-exclusion-by-construction (preferred over redaction).** Where possible, make the log/event **type physically incapable** of holding free-form content — a struct of allowlisted scalar fields, no `payload`/`body`/`extra: any`. A type that cannot carry a phone number has no scrubber to fail; redaction (next item) is the fallback when a content field is unavoidable, not the first line of defence.
 3. **Logger-level redaction.** Configure the logger to scrub `email`, `phone`, `name`, `address`, `token`, `password`, `card_number`, `iban` keys recursively from any payload.
 4. **No raw exception payloads.** Exceptions captured by Sentry / Bugsnag must scrub the request body via the SDK's `before_send` hook.
 5. **No log-and-forget for auth flows.** Login / password-reset / token-mint logs never include the credential itself, only the actor + outcome.

package/dist/agent-src/rules/external-code-graph-interop.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "When the repo ships an external code-graph index (a graph.json-shaped artifact or a SCIP index), query IT first for codebase-structure questions — do not grep from scratch"
+description: "Repo ships a code-graph index (graph.json-shaped or SCIP) — query IT first for codebase-structure questions, do not grep from scratch"
 triggers:
   - keyword: "scip"
   - keyword: "code-graph"
@@ -64,10 +64,10 @@ AND the repo contains a detectable index:
 ## See also
 
 - [`code-intelligence`](../skills/code-intelligence/SKILL.md) — the executable
-  routing skill: `code_graph detect|query|affected|path` over the native engine
-  or a consumer-shipped index, grep as the stated fallback. On hook-capable
-  hosts the PreToolUse `code-graph` nudge surfaces this once per session; on
-  instruction-file hosts this rule is the surface.
+  routing skill: `agent-config code-graph detect|query|affected|path` over the
+  native engine or a consumer-shipped index, grep as the stated fallback. On
+  hook-capable hosts the PreToolUse `code-graph` nudge surfaces this once per
+  session; on instruction-file hosts this rule is the surface.
 - [`discovery_graph`](../scripts/discovery_graph.ts) — this suite's OWN artefact
   relation-graph (`affected`/`explain`); the external code-graph is the
   *source-code* analogue this rule defers to for code questions.

package/dist/agent-src/rules/fast-path-marker-visibility.md

@@ -18,6 +18,12 @@ packs: [meta]
 
 # Fast-Path Marker Visibility
 
+When a decision resolves through the low-impact council fast-path (corpus
+match, fuzzy match, or any other `decision_resolution.classes.low_impact`
+opt-in route), the dispatcher emits a transparency marker. The host agent
+**must** surface that marker verbatim — never swallow it, never paraphrase
+it, never fold it into a same-sounding summary.
+
 ## The Iron Law
 
 ```
@@ -25,23 +31,53 @@ EVERY LOW-IMPACT COUNCIL FAST-PATH REPLY OPENS WITH THE EXACT MARKER.
 NEVER PARAPHRASE. NEVER SWALLOW. NEVER SUBSTITUTE THE AGENT'S OWN VERDICT.
 ```
 
-Markers (from `scripts/ai_council/low_impact.ts`):
+Applies to **every** fast-path outcome:
 
 - **Resolved** — `> Resolved via low-impact council fast-path: <verdict>.`
 - **Unavailable** — `> Low-impact council unavailable (no opted-in members) — escalating to user.`
 - **Split** — `> Low-impact council split — escalating to user (<m1>: X / <m2>: Y):`
 - **Aborted** — `> Low-impact council aborted (token cap) — escalating to user:`
 
-Verbatim = first non-whitespace line, English (no translation), no emoji prefix, no merged numbered-options. Marker is the only audit signal that distinguishes fast-path from local deliberation. See `.agent-src.uncondensed/rules/fast-path-marker-visibility.md` for full failure modes.
+Markers from `scripts/ai_council/low_impact.ts`. Wording is normative —
+case, punctuation, and the leading `> ` blockquote prefix all matter so
+that downstream agents and tooling can pattern-match.
+
+## What "verbatim" means
+
+- First non-whitespace line of the reply is the marker.
+- No prose, greeting, or restating-the-question above it.
+- No translation: the marker is English even when the user wrote in
+  another language. `language-and-tone` Iron-Law mirror applies to the
+  prose **after** the marker, not the marker itself.
+- No emoji decoration, no trailing rationale on the same line.
+- The marker appears **once**. Subsequent prose explains the verdict.
+
+## Why
+
+The marker is the only audit signal that distinguishes a fast-path
+resolution from the agent's own reasoning. Swallowing it converts an
+opt-in observability surface into a silent substitution — the user can no
+longer tell whether the council bypassed their judgement or the agent
+deliberated locally. This is the same failure mode that `direct-answers
+§ Iron Law 2` forbids for invented facts, applied to dispatch provenance.
 
 ## Failure modes
 
-- Opening with `Found it` / `Looks like` / `Here's the verdict` — drops the marker. **Violation.**
-- Translating the marker to non-English. **Violation.**
+- Opening with `Found it` / `Looks like` / `Here's the verdict` — drops
+  the marker. **Violation.**
+- Translating the marker to German / Spanish / any non-English. **Violation.**
 - Adding emoji prefix (`✅ Resolved via …`) — alters the literal. **Violation.**
-- Indenting beyond the leading `> ` — breaks pattern match. **Violation.**
+- Indenting the marker beyond the leading `> ` — breaks pattern match. **Violation.**
 - Merging marker into a numbered-options block. **Violation.**
 
-Scope: `low_impact` class only. `high_impact` and `user_required` never reach fast-path.
+## Scope
+
+Only fires for `low_impact` dispatch outcomes. `high_impact` and
+`user_required` classes never reach the fast-path and have no marker —
+this rule does not constrain their output.
+
+## See also
 
-See: [`ai-council-config § Low-impact council opt-in`](../docs/contracts/ai-council-config.md#low-impact-council-opt-in), [`direct-answers`](direct-answers.md) (invented-facts Iron Law kin).
+- [`ai-council-config § Low-impact council opt-in`](../docs/contracts/ai-council-config.md#low-impact-council-opt-in)
+- [`direct-answers`](direct-answers.md) — invented-facts Iron Law (provenance kin).
+- `scripts/ai_council/low_impact.ts` — marker source.

package/dist/agent-src/rules/finance-safety-floor.md

@@ -36,7 +36,7 @@ trust:
   human_review_required: true
 ---
 <!-- agent-config:human-review-banner -->
-> HUMAN REVIEW REQUIRED · trust: advisory · owner: finance
+> HUMAN REVIEW REQUIRED · trust: advisory · owner: unknown
 
 # Finance Safety Floor
 

package/dist/agent-src/rules/framework-neutrality-in-generic-skills.md

@@ -3,9 +3,9 @@ type: "auto"
 tier: "2a"
 description: "Editing a generic skill/rule/command — no single-stack mandates; carve-out pointers instead"
 triggers:
-  - path_prefix: ".agent-src.uncondensed/skills/"
-  - path_prefix: ".agent-src.uncondensed/rules/"
-  - path_prefix: ".agent-src.uncondensed/commands/"
+  - path_prefix: "src/skills/"
+  - path_prefix: "src/rules/"
+  - path_prefix: "src/agent-src/commands/"
   - keyword: "FormRequest"
   - keyword: "PHPStan"
   - keyword: "php artisan"

package/dist/agent-src/rules/history-discipline.md

@@ -0,0 +1,80 @@
+---
+type: "auto"
+tier: "2a"
+description: "Change history — audit coverage, cheapest-sufficient tier (default row-level audit log; event sourcing by waiver), hygiene + privacy interlocks"
+triggers:
+  - keyword: "audit"
+  - keyword: "audit log"
+  - keyword: "activity log"
+  - keyword: "history"
+  - keyword: "event sourcing"
+  - keyword: "changelog"
+  - phrase: "who changed"
+  - phrase: "wer hat was"
+  - phrase: "track changes"
+  - phrase: "change history"
+routes_to:
+  - "skill:history-design"
+workspaces: [engineering]
+packs: [history-discipline]
+trust:
+  level: professional
+---
+
+# History Discipline
+
+Pack floor for the `history-discipline` pack (default-off; auto-activates
+when the pack is installed). Agents get history wrong in both directions:
+missing entirely on data that needs it, or over-built as event sourcing
+where a row-level log suffices — and audit tables that themselves grow
+without bound.
+
+## The Iron Law
+
+```
+MUTATIONS ON AUDIT-SCOPED DATA EMIT WHO / WHAT / WHEN. ALWAYS.
+THE MECHANISM IS THE CHEAPEST SUFFICIENT TIER — DEFAULT: ROW-LEVEL
+AUDIT LOG. EVENT SOURCING ONLY WITH AN EXPLICIT ARCHITECTURE WAIVER.
+THE AUDIT TABLE OBEYS THE SAME GROWTH BUDGET AS EVERY OTHER TABLE.
+AUDIT RECORDS INHERIT THE PRIVACY OBLIGATIONS OF THE DATA THEY DESCRIBE.
+A LOSSY AUDIT TRAIL IS WORSE THAN NONE.
+```
+
+## Rule surface
+
+- **R-B1 audit-coverage** — mutations on declared audit-scoped models
+  emit who/what/when (actor id, diff or event, timestamp, correlation
+  id) (F8; checked by `lint_persistence` against the declared scope).
+- **R-B2 history-tier-selection** — the tier matrix is normative
+  (Tier 0 `updated_by` columns → Tier 1 row-level audit log → Tier 2
+  temporal tables → Tier 3 event sourcing). **Default: Tier 1.** Tier 3
+  requires an explicit architecture waiver — never upgrade unprompted.
+  The matrix and interlock walkthrough live in
+  [`history-design`](../skills/history-design/SKILL.md).
+- **R-B3 audit-table-hygiene** — audit storage indexed on
+  `(auditable_type, auditable_id, created_at)`; JSON diffs, not full-row
+  copies, where a diff suffices.
+- **R-B4 privacy-interlock** — a GDPR Art. 17 deletion/anonymization path
+  must exist for audit records before the mechanism ships.
+- **R-B5 reliable-history-interlock** — audit capture is same-transaction
+  (Tier-1 default: observer + cheap single insert) OR outbox/afterCommit
+  with a durable queue when offloaded — per
+  [`scale-discipline`](scale-discipline.md) R-A10/R-A11.
+
+## When NOT to fire
+
+- Git/VCS history questions (that is `git-workflow` territory).
+- Retention-duration policy questions ("how long may we keep X") — route
+  to `domain-safety-retention`; this rule owns the capture mechanism,
+  not the legal floor.
+
+## See also
+
+- [`history-design`](../skills/history-design/SKILL.md) — the tier
+  matrix walkthrough + decision artifact.
+- [`scale-discipline`](scale-discipline.md) — R-A7 growth budget and
+  R-A10/R-A11 reliability primitives this pack builds on.
+- [`domain-safety-retention`](domain-safety-retention.md) — jurisdiction
+  retention floors the R-A7 policy must respect.
+- [`domain-safety-pii`](domain-safety-pii.md) — PII discipline for what
+  audit diffs may contain.

package/dist/agent-src/rules/legal-safety-floor.md

@@ -30,7 +30,7 @@ trust:
   human_review_required: true
 ---
 <!-- agent-config:human-review-banner -->
-> HUMAN REVIEW REQUIRED · trust: advisory · owner: legal
+> HUMAN REVIEW REQUIRED · trust: advisory · owner: unknown
 
 # Legal Safety Floor
 

package/dist/agent-src/rules/lethal-trifecta-guard.md

@@ -23,11 +23,11 @@ enforced_by:
 Prompt injection is not solvable at the model layer (OWASP LLM01). It is
 contained **architecturally**: a tool/skill/command becomes dangerous only when
 it combines all three legs of the *lethal trifecta*. Remove one leg and an
-injected instruction can do no consequential harm. This is the agentic attack
-surface OWASP's Agentic Security Initiative (ASI Top 10) catalogues — excessive
-agency, tool misuse, confused-deputy data exfiltration; the Least-Agency
-discipline in [`tool-safety`](tool-safety.md) is the same defence applied to the
-tool grant.
+injected instruction can do no consequential harm. This is the agentic
+attack surface OWASP's Agentic Security Initiative (ASI Top 10) catalogues —
+excessive agency, tool misuse, and confused-deputy data exfiltration; the
+Least-Agency discipline in [`tool-safety`](tool-safety.md) is the same defence
+applied to the tool grant.
 
 ## The Iron Law
 

package/dist/agent-src/rules/low-impact-corpus-privacy-floor.md

@@ -21,17 +21,17 @@ NO SECRETS. NO EMAILS. NO PROJECT PATHS. NO CUSTOMER NAMES.
 NO INTERNAL HOSTNAMES. NO MONEY. NO BUSINESS SQL. NO LONG CODE.
 ```
 
-Redactor lives in `scripts/ai_council/redact_low_impact_entry.ts`
+The redactor lives in `scripts/ai_council/redact_low_impact_entry.ts`
 and runs at **both** gates:
 
 1. **Write gate** — every intake append to
    `agents/decisions/low-impact-decisions.md` (Phase 12 § Step 2).
 2. **Upstream gate** — every `/memory learn-low-impact` PR draft,
-   before diff leaves repo (Phase 12 § Step 5).
+   before the diff leaves the repo (Phase 12 § Step 5).
 
-Failure at either gate refuses the operation, surfaces offending
-pattern, asks user to rephrase. Redactor never auto-rewrites — silent
-rewriting is soft gate, this is hard.
+A failure at either gate refuses the operation, surfaces the
+offending pattern, and asks the user to rephrase. The redactor never
+auto-rewrites — silent rewriting is a soft gate, this is hard.
 
 ## Forbidden-content classes (8)
 
@@ -54,9 +54,10 @@ rewriting is soft gate, this is hard.
 
 ## When to invoke
 
-- Host agent just received user intake trigger (see
+- The host agent has just received a user intake trigger (see
   `scripts/ai_council/low_impact_intake.TRIGGER_PHRASES`).
-- Host agent about to write entry to corpus or open `/memory learn-low-impact` PR.
+- The host agent is about to write an entry to the corpus or to
+  open a `/memory learn-low-impact` PR.
 
 ## What to surface on refusal
 
@@ -66,7 +67,8 @@ One-line marker:
 > Low-impact corpus refused — <category>: <snippet…>. Rephrase or skip.
 ```
 
-Then agent stops intake/upstream flow. No silent retry, no auto-rewrite.
+Then the agent stops the intake / upstream flow. No silent retry, no
+auto-rewrite.
 
 ## See also
 

package/dist/agent-src/rules/media-governance-routing.md

@@ -42,11 +42,11 @@ MEDIA POLICIES IN agents/settings/policies/media/ BEFORE EMITTING THE PROMPT TO
 THE PROVIDER. REFUSE-AND-SURFACE OVER GUESS-AND-RENDER.
 ```
 
-Routes agent to project-local media governance policy layer at [`agents/settings/policies/media/`](../../agents/settings/policies/media/) when video / image / voice surface fires. Policies are LLM-readable decision frameworks consulted in-session, not Python-enforced gates — see [`agents/settings/policies/media/README.md § Enforcement model`](../../agents/settings/policies/media/README.md) for full agent-in-the-loop contract.
+This rule routes the agent to the **project-local** media governance policy layer at [`agents/settings/policies/media/`](../../agents/settings/policies/media/) whenever a video / image / voice surface fires. The policies themselves are LLM-readable decision frameworks consulted in-session, not Python-enforced gates — see [`agents/settings/policies/media/README.md § Enforcement model`](../../agents/settings/policies/media/README.md) for the full agent-in-the-loop contract.
 
 ## What this rule surfaces
 
-Any trigger match → agent loads into context:
+When any trigger above matches in the user prompt or in a tool invocation, the agent loads into context:
 
 - [`agents/settings/policies/media/likeness.md`](../../agents/settings/policies/media/likeness.md) — real person's visual likeness.
 - [`agents/settings/policies/media/style.md`](../../agents/settings/policies/media/style.md) — named living artist's distinctive style.
@@ -56,30 +56,30 @@ Any trigger match → agent loads into context:
 - [`agents/settings/policies/media/brand-impersonation.md`](../../agents/settings/policies/media/brand-impersonation.md) — brand / broadcaster identity imitation.
 - [`agents/settings/policies/media/transparency.md`](../../agents/settings/policies/media/transparency.md) — provenance metadata (C2PA, SynthID).
 
-Each policy carries own trigger block → within active context agent narrows from superset to policies whose specific patterns actually fired (e.g. prompt naming public figure → `public-figures.md` + `disclosure.md`; `--no-disclosure` → `disclosure.md` standalone).
+Each policy carries its own trigger block, so within the active context the agent narrows from this superset to the policies whose specific patterns actually fired (e.g., a prompt naming a public figure activates `public-figures.md` and `disclosure.md`; a prompt requesting `--no-disclosure` activates `disclosure.md` standalone).
 
 ## Why project-local, not `.agent-src.uncondensed/rules/`
 
-Seven media policies live under [`agents/settings/policies/media/`](../../agents/settings/policies/media/), not as `.agent-src.uncondensed/rules/domain-safety-media-*.md`, for three reasons:
+The seven media policies live under [`agents/settings/policies/media/`](../../agents/settings/policies/media/), not as `.agent-src.uncondensed/rules/domain-safety-media-*.md`, for three reasons:
 
-1. **Consumed by skills + adapters**, not surfaced as standalone always-loaded prose. Cost non-trivial (7 × ~80 lines = ~560 lines always-context if hoisted to rules), and most sessions never touch video / image / voice surface.
-2. **Enforcement model project-local** — working precedent (`/ghostwriter:*` mandatory footer in `write-engine.md`) + audit log (session transcripts) are project artifacts. Rules under `.agent-src.uncondensed/` are tool-portable governance; these policies are domain-specific bindings.
-3. **Extraction to reusable domain pack explicitly deferred** until second non-video domain (audio, image, docs, exports) lands with overlapping execution surfaces. Until then, one-domain abstraction structurally premature — policies stay project-local, routing rule on-demand bridge.
+1. **They are consumed by skills and adapters**, not surfaced as standalone always-loaded prose. The cost is non-trivial (7 × ~80 lines = ~560 lines into the always-context if hoisted to rules), and most sessions never touch a video / image / voice surface.
+2. **The enforcement model is project-local** — the working precedent (`/ghostwriter:*` mandatory footer in `write-engine.md`) and the audit log (session transcripts) are project artifacts. Rules under `.agent-src.uncondensed/` are tool-portable governance; these policies are domain-specific bindings.
+3. **Extraction to a reusable domain pack is explicitly deferred** until a second non-video domain (audio, image, docs, exports) lands with overlapping execution surfaces. Until then, a one-domain abstraction is structurally premature — the policies stay project-local and the routing rule is the on-demand bridge.
 
-This routing rule is the bridge: sits in always-loaded rule set so trigger keywords surface project-local policies into context on demand, without paying full always-loaded cost.
+This routing rule is the bridge: it sits in the always-loaded rule set so the trigger keywords surface the project-local policies into context on demand, without paying the full always-loaded cost.
 
 ## CI reachability guarantee
 
-[`scripts/lint_media_policy_linkage.ts`](../../scripts/lint_media_policy_linkage.ts) fails build if any policy file under `agents/settings/policies/media/` not linked from:
+[`scripts/lint_media_policy_linkage.ts`](../../scripts/lint_media_policy_linkage.ts) fails the build if any policy file under `agents/settings/policies/media/` is not linked from:
 
 - this routing rule, **or**
 - a skill's `## Policies` see-also block, **or**
 - another policy file's `## See also` block.
 
-Policy that no skill, rule, or sibling policy references → silent policy. CI check is structural reachability guarantee that agent-in-the-loop model rests on.
+A policy that no skill, rule, or sibling policy references is a silent policy. The CI check is the structural reachability guarantee that the agent-in-the-loop model rests on.
 
 ## See also
 
-- [`agents/settings/policies/media/README.md`](../../agents/settings/policies/media/README.md) — full enforcement-model contract.
-- [`ask-when-uncertain`](ask-when-uncertain.md) — single-question refusal-path discipline every policy depends on.
-- [`docs/contracts/write-engine.md`](../docs/contracts/write-engine.md) — prose-disclosure precedent extended to media by [`disclosure.md`](../../agents/settings/policies/media/disclosure.md).
+- [`agents/settings/policies/media/README.md`](../../agents/settings/policies/media/README.md) — the full enforcement-model contract.
+- [`ask-when-uncertain`](ask-when-uncertain.md) — the single-question refusal-path discipline every policy depends on.
+- [`docs/contracts/write-engine.md`](../docs/contracts/write-engine.md) — the prose-disclosure precedent extended to media by [`disclosure.md`](../../agents/settings/policies/media/disclosure.md).

package/dist/agent-src/rules/media-sync-ground-truth.md

@@ -30,23 +30,41 @@ WRONG-SINGER-ON-WRONG-LINE IS A RENDER-MONEY-BURNING FAILURE.
 MAP → SIGN-OFF → RENDER. NO BLIND BATCHES.
 ```
 
-For audio-synced video (lip-sync, beat-aligned cuts, music videos), truth for **timing** + **who-sings-what** is the **actual audio** — transcribed to timestamped lines with a singer per segment. A creative skeleton (story / Drehbuch) encodes *intent*, not the delivered audio; a guessed stretch makes it worse. Lip-sync amplifies every mismatch — wrong mouth on wrong words is instantly, glaringly wrong, and the render already cost money.
+When generating audio-synced video (lip-sync, beat-aligned cuts, music
+videos), the source of truth for **timing** and **who-sings-what** is the
+**actual audio artifact** — transcribed to timestamped lines with a
+singer per segment. A creative skeleton (story / Drehbuch) encodes
+*intent*, not the *delivered* audio; a guessed stretch factor makes it
+worse. Lip-sync amplifies every mismatch — the wrong mouth on the wrong
+words is instantly, glaringly wrong, and the render already cost money.
 
 ## What this requires
 
-1. **Transcribe the real audio** → timestamped lines (OpenAI `/v1/audio/transcriptions` or whisper). Probe gives duration; transcript gives structure. Build `<project>/vocal-map.json`: `[{start, end, text, singer}]`.
-2. **Label singers onto the transcribed timeline**, never the reverse. A who-sings doc only *labels* lines; never *defines* the timeline.
-3. **Align cuts to real lyrical/musical phrases** — not arbitrary fixed-length windows.
-4. **Each vocal line lip-syncs to its OWN singer.** Never cross-assign one character's mouth onto another's part.
-5. **Sign-off gate** — surface the vocal map (timestamp → line → singer → shot) for explicit operator approval **before** any paid render.
-6. **Lip-sync sparingly** — only where a frontal close-up of the correct singer supports it; model lip-sync on singing is imperfect, so use cinematic motion (dop) for the rest.
+1. **Transcribe the real audio** → timestamped lines (OpenAI
+   `/v1/audio/transcriptions` or whisper). The probe gives duration; the
+   transcript gives structure. Build `<project>/vocal-map.json`:
+   `[{start, end, text, singer}]`.
+2. **Label singers onto the transcribed timeline**, never the reverse. A
+   who-sings doc only *labels* lines; it never *defines* the timeline.
+3. **Align cuts to real lyrical/musical phrases** — not arbitrary
+   fixed-length windows.
+4. **Each vocal line lip-syncs to its OWN singer.** Never cross-assign one
+   character's mouth onto another's part.
+5. **Sign-off gate** — surface the vocal map (timestamp → line → singer →
+   shot) for explicit operator approval **before** any paid render.
+6. **Lip-sync sparingly** — only where a frontal close-up of the correct
+   singer supports it; model lip-sync on singing is imperfect, so use
+   cinematic motion (dop) for the rest.
 
 ## Failure modes
 
-- Stretched `story.md` as singer/timing source → one character mouths another's lines (canonical odins-beard failure).
-- Fixed 5s windows landing off-phrase → jarring cuts + weird mouth motion.
-- Firing a multi-clip batch before the vocal map is approved → budget burned on throwaway output.
-- Trusting a guessed time-stretch to "match" the song length.
+- Using a stretched `story.md` as the singer/timing source → one character
+  ends up mouthing another's lines (the canonical odins-beard failure).
+- Chunking the song into fixed 5s windows that land off-phrase → jarring
+  cuts + weird mouth motion.
+- Firing a multi-clip render batch before the vocal map is approved →
+  budget burned on output that must be thrown away.
+- Trusting a guessed time-stretch factor to "match" the song length.
 
 ## See also