@event4u/agent-config 9.8.0 → 9.10.0

package/dist/agent-src/rules/no-cheap-questions.md

@@ -9,7 +9,7 @@ packs: [meta]
 
 # No Cheap Questions
 
-Cheap = context answers it, an option breaches an Iron Law, choices differ only in sequencing/format, or one option dominates. Mode-independent; autonomy never lifts the floor.
+Cheap = context answers it, an option breaches an Iron Law, choices differ only in sequencing/format, or one dominates. Mode-independent; autonomy never lifts the floor.
 
 ## The Iron Laws
 
@@ -19,7 +19,7 @@ NEVER OFFER AN IRON-LAW-VIOLATING OPTION.
 NEVER NUMBER CHOICES WITHOUT A REAL TRADE-OFF.
 ```
 
-Cheap-class catalog + IL 3 (no paternalistic state-assuming options): [`cheap-question-mechanics`](../contexts/execution/cheap-question-mechanics.md).
+Cheap-class catalog + IL 3 (no state-assuming options): [`cheap-question-mechanics`](../contexts/execution/cheap-question-mechanics.md).
 
 ## Iron Law 4 — No Continuation Prompts Under Autonomous Mandate
 
@@ -39,7 +39,7 @@ USER AUTHORIZES X ("COMMIT" / "PUSH" / "OPEN PR" / "DEPLOY")
 "DO THE PREREQ" vs "SKIP AND BREAK THE GATE".
 ```
 
-Prereq catalog + halt conditions: [`cheap-question-mechanics`](../contexts/execution/cheap-question-mechanics.md).
+Prereq catalog + halts: [`cheap-question-mechanics`](../contexts/execution/cheap-question-mechanics.md).
 
 ## Iron Law 6 — Destination Already Stated, Never Re-Ask
 
@@ -48,7 +48,7 @@ USER NAMED THE DESTINATION → DO NOT RE-ASK.
 NO BRANCH-BASE INVENTORY, NO "WHICH BRANCH?", NO "NEW PR?".
 ```
 
-Triggers + scope-control interaction: [`cheap-question-mechanics`](../contexts/execution/cheap-question-mechanics.md).
+Triggers + scope-control interplay: [`cheap-question-mechanics`](../contexts/execution/cheap-question-mechanics.md).
 
 ## Pre-Send Self-Check — MANDATORY before every question
 
@@ -65,8 +65,8 @@ Silent, before any numbered-options block. Any "yes" → don't ask:
 9. Prereq for user-authorized action? IL 5, execute silently.
 10. Destination (branch / PR) already named? IL 6, never re-ask.
 11. Cleanup of gitignored / auto-pruned / TTL-managed artefact? Self-managing — state inline, never offer.
-12. Numbered option contains a commit-message body, "message preview", or "Vorschlag falls Du committen willst"? Disguised commit ask — `commit-policy` violation, drop it.
-13. Commit authorized + asking "one commit or multiple?", "how should I split?", "which chunk first?"? Forbidden — `commit-policy § Always split into logical chunks`. Pick the split, state inline, execute.
-14. Artifact just landed (roadmap / ADR / plan / pitch / ticket) + offering "ready to start Phase 1?", "begin execution?", or a `/roadmap:process-*` menu? Forbidden — `scope-control § Authoring vs. implementation` + `scope-mechanics § Post-artifact hard stop`. Authoring verbs never inherit execution authorization. Emit the hand-back line, stop the turn.
+12. Numbered option carries a commit-message body, "message preview", or "Vorschlag falls Du committen willst"? Disguised commit ask — `commit-policy` violation, drop it.
+13. Commit authorized + asking "one commit or multiple?", "how should I split?", "which chunk first?"? Forbidden — `commit-policy § Always split into logical chunks`. Pick the split, state it inline, execute.
+14. Artifact just landed (roadmap / ADR / plan / pitch / ticket / design doc) + offering "ready to start Phase 1?", "begin execution?", or a `/roadmap:process-*` menu? Forbidden — `scope-control § Authoring vs. implementation` + `scope-mechanics § Post-artifact hard stop`. Authoring verbs never inherit execution authorization. Emit the hand-back line, stop the turn.
 
 Pick the dominant path, state the assumption inline, hand back. Genuine ambiguity → [`ask-when-uncertain`](ask-when-uncertain.md). In doubt → ask: this rule narrows asking, never widens silence. When asking IS allowed: [`cheap-question-mechanics`](../contexts/execution/cheap-question-mechanics.md).

package/dist/agent-src/rules/no-decorative-emojis-in-git-surfaces.md

@@ -29,24 +29,26 @@ EVERY EMOJI USED. NO LEGEND → NO EMOJI.
 EXCEPTION: USER EXPLICITLY ASKED FOR IT THIS TURN.
 ```
 
-Decorative = visual flair, ranking, mood, "look how fancy". Functional emojis below stay allowed.
+Decorative = added for visual flair, ranking, mood, or "look how
+fancy". Functional emojis below are not decorative and stay allowed.
 
 ## Surfaces — what this gates
 
-Always blocked (titles + free-standing comments):
+Always blocked (title surfaces + free-standing comment threads):
 
 - PR titles (`gh pr create --title`, `octokit.pulls.create`, PATCH).
 - Issue titles (`gh issue create`, `octokit.issues.create`, PATCH).
-- Commit subject (first line of `git commit -m` / message file).
+- Commit subject line (first line of `git commit -m` / message file).
 - Branch names.
 - Standalone PR / issue comments (`gh pr comment`, `gh issue comment`,
   `octokit.issues.createComment`) — covers everything `no-pr-progress-comments`
   lets through (review-replies, user-invoked comment flows).
 
-Body-only, legend-gated:
+Conditional, body-only — emojis allowed when a legend in the same
+artifact defines every emoji used (see below):
 
-- PR / issue descriptions (body of create / PATCH payload).
-- Commit body (lines below the blank-line subject separator).
+- PR / issue descriptions (body of the create / PATCH payload).
+- Commit body (lines after the blank-line separator below the subject).
 
 ## Universal blacklist — forbidden even with a legend
 
@@ -54,28 +56,37 @@ Body-only, legend-gated:
 🤖 🚀 🎉 ✨ 🔥 💡 👍 ❤️ 🤗 😊 (and skin-tone / variant forms)
 ```
 
-"Look how fancy" / empathy classes from `direct-answers`. Self-attribution (🤖) is the punkpeye PR (#6865 title-emoji spam) pattern. No legend rescues them.
+These are the "look how fancy" / empathy classes from `direct-answers`.
+Self-attribution (🤖) is the canonical violation pattern from the
+punkpeye PR (#6865 title-emoji spam). No legend rescues them.
 
-## Legend carve-out — when body emojis ARE allowed
+## Legend carve-out — when decorative emojis ARE allowed in a body
 
-All three must hold for the same artifact:
+Allowed only when ALL of the following hold for the same artifact:
 
-1. Body contains a `Legend:` (or `Legende:`) block on its own line defining every decorative emoji used elsewhere in the body.
-2. Emojis carry **information** (language tag, OS marker, hosting class) — not pure decoration. Example punkpeye-#6865 body:
+1. The body contains a `Legend:` (or `Legende:`) block on its own line
+   that defines every decorative emoji used elsewhere in the body.
+2. The emojis carry **information** (language tag, OS marker, hosting
+   class) — they are not pure decoration. Compare punkpeye-#6865 body:
    `📇 TypeScript · ☁️ Cloud · 🏠 Local · 🍎 macOS · 🪟 Windows · 🐧 Linux`.
 3. No universal-blacklist emoji appears (above list always wins).
 
 Body emojis without a legend → strip before posting / committing.
 
-## Whitelist — always allowed, no legend
+## Whitelist — always allowed, no legend needed
 
-- CLI / agent-status markers: `❌` `✅` `⚠️` (literal status).
+- CLI / agent-status markers: `❌` `✅` `⚠️` (carry literal status).
 - Mode markers from `role-mode-adherence`.
-- Roadmap checkbox glyphs (`[x]` `[~]` `[-]`) in fenced code or quoted roadmap excerpts — not emojis, no carve-out needed.
+- Roadmap checkbox glyphs (`[x]` `[~]` `[-]`) inside fenced code or
+  quoted roadmap excerpts — these are not emojis, no carve-out needed.
 
 ## Server-side re-injection
 
-Host AI client or tool wrapper re-injects 🤖 / 🎉 into a title or comment after creation (analog to the `Pull Request opened by …` injection in `no-attribution-footers`) → same mitigation: re-fetch after create, regex-strip, PATCH if changed, re-fetch to verify.
+If the host AI client or tool wrapper re-injects 🤖 / 🎉 into a title
+or comment after creation (analog to the `Pull Request opened by …`
+injection covered in `no-attribution-footers`), the same mitigation
+applies: re-fetch after create, regex-strip the offending characters,
+PATCH if changed, re-fetch to verify.
 
 ## Failure modes — what counts as a violation
 
@@ -83,7 +94,7 @@ Host AI client or tool wrapper re-injects 🤖 / 🎉 into a title or comment af
 - PR title `🤖 Update dependencies` — title-emoji spam (punkpeye #6865).
 - Comment body `🎉 All checks green now!` — decorative comment.
 - PR body with `Status: 🟢 Ready` — no legend, no carve-out.
-- Branch `feat/🔥-new-thing` — emoji in ref name.
+- Branch named `feat/🔥-new-thing` — emoji in ref name.
 - Body legend present but body also uses 🤖 — universal blacklist wins.
 
 ## See also
@@ -95,5 +106,5 @@ Host AI client or tool wrapper re-injects 🤖 / 🎉 into a title or comment af
   that does get posted.
 - [`commit-conventions`](commit-conventions.md) — Conventional Commits
   format; this rule narrows the allowed character set in the subject.
-- [`direct-answers`](direct-answers.md) § Emoji Scope — chat-reply analog;
-  same emoji classes, different surface.
+- [`direct-answers`](direct-answers.md) § Emoji Scope — the chat-reply
+  analog; same emoji classes, different surface.

package/dist/agent-src/rules/no-roadmap-references.md

@@ -73,6 +73,6 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 - [`roadmap-progress-sync`](roadmap-progress-sync.md) — sync dashboard
   on roadmap touch
 - [`source-of-truth`](source-of-truth.md) — edit
-  `.agent-src.uncondensed/`
+  `src/`
 - [`ai-council`](../skills/ai-council/SKILL.md) — output path
   convention and convergence-summary format

package/dist/agent-src/rules/non-destructive-by-default.md

@@ -23,22 +23,22 @@ NO AUTONOMY SETTING, NO ROADMAP STEP, NO STANDING INSTRUCTION,
 NO "JUST KEEP GOING" CAN BYPASS IT.
 ```
 
-Triggers below require explicit user confirmation **on this turn** — not from a previous turn, not from a roadmap, not from a standing autonomy directive (anchor list: [`autonomous-execution`](autonomous-execution.md)):
+Triggers below require explicit user confirmation **on this turn** — not a previous turn, not a roadmap, not a standing autonomy directive (anchor: [`autonomous-execution`](autonomous-execution.md)):
 
 | Trigger | Examples |
 |---|---|
 | **Production-branch merge** | `main`, `master`, `prod`, `production`, `release/*`, or any project-marked deployment trunk |
-| **Commit on a production branch** | any `git commit` while `HEAD` is on a prod trunk. **Verify branch before every commit** — `main` is opt-in only, never inferred from a prior turn or a merged PR that left HEAD on `main` |
+| **Commit on a production branch** | any `git commit` while `HEAD` is on a prod trunk. **Verify branch before every commit** — `main` is opt-in only, never inferred from a prior turn or a merged PR that left HEAD there |
 | **Deploy / release** | prod `terraform apply` / `kubectl apply`, deploy scripts, release commands, CI-deploying tag pushes |
 | **Push to remote** | any `git push` (also covered by [`scope-control`](scope-control.md), restated so the floor never weakens) |
 | **Production data / infra** | prod DB writes / migrations, prod config, secrets rotation, IAM / role / policy, DNS, anything in a `prod`-scoped path or pipeline |
 | **Whimsical / unscoped bulk deletion** | `rm -rf <dir>`, `git rm -r`, glob deletes, `DROP TABLE`, `TRUNCATE`, `git reset --hard` past unpushed work — when **not required** by the task (task-aligned WIP deletions allowed, below) |
 | **Commit containing bulk deletions or infra changes** | diff removes a directory, deletes ≥5 unrelated files, or touches Terraform/Pulumi/k8s/Ansible/cloud-config — surface the diff + confirm even when [`commit-policy`](commit-policy.md) authorizes |
-| **Irreversible external action** | **send** / **publish** / **post** / **purchase** / **submit** — an outbound, externally-visible, or money-moving action the user cannot un-see: send an email/message, publish or post content, submit a form, place an order or payment. Also gated by [`scope-control`](scope-control.md) external-comms; named here so the Hard Floor lists the actual buttons |
+| **Irreversible external action** | **send** / **publish** / **post** / **purchase** / **submit** — outbound, externally-visible, or money-moving actions the user cannot un-see: email/message, publish or post content, submit a form, place an order or payment. Also gated by [`scope-control`](scope-control.md) external-comms; named here so the Hard Floor lists the actual buttons |
 
 Standing "just keep going" + next step crosses the floor → STOP, surface it (one numbered-options block per [`user-interaction`](user-interaction.md)), wait.
 
-**Never act while asking.** The ask and the action are strictly sequential: surface the confirmation, then WAIT for the answer. Never fire the action in the same turn you ask for it — no do-then-ask race, no "I went ahead and…". **The approval names the exact object** so the user confirms the real thing, not a category: a download names filename + size + source; a purchase names amount + card-last4 + total; a send names recipient + subject. Shape per [`user-interaction`](user-interaction.md) numbered-options.
+**Never act while asking.** Ask and action are strictly sequential: surface the confirmation, then WAIT. Never fire the action in the turn you ask — no do-then-ask race, no "I went ahead and…". **The approval names the exact object**, not a category: a download names filename + size + source; a purchase names amount + card-last4 + total; a send names recipient + subject. Shape per [`user-interaction`](user-interaction.md) numbered-options.
 
 ## Not in scope — deterministic regeneration
 
@@ -46,7 +46,7 @@ Output regenerated from a tracked source (condensation, code-gen, formatters, lo
 
 ## Bulk deletions during WIP — allowed if task-connected
 
-Deletions inside an **active, user-stated task** are allowed in the working tree — the Hard Floor moves to the **commit** (row 6). Whimsical / drive-by / unnamed-scope deletions still trip the floor on the edit. Allowed/forbidden lists: [`destructive-mechanics`](../contexts/authority/destructive-mechanics.md).
+Deletions inside an **active, user-stated task** are allowed in the working tree — the Hard Floor moves to the **commit** (row 6). Whimsical / drive-by / unnamed-scope deletions still trip the floor on the edit. Lists: [`destructive-mechanics`](../contexts/authority/destructive-mechanics.md).
 
 ## Failure modes
 
@@ -59,21 +59,3 @@ Applies on every surface — web, Skills API, any cloud agent. No "cloud overrid
 ## See also
 
 [`autonomous-execution`](autonomous-execution.md) · [`commit-policy`](commit-policy.md) · [`scope-control`](scope-control.md) · [`user-interaction`](user-interaction.md).
-
-## Enforcement — stated honestly (`enforced_by: none`)
-
-This floor has **no mechanical backstop**, and pretending otherwise would be the
-failure it exists to prevent. No script can enforce "ask before you deploy" — the
-obligation is to pause and surface, and the only thing that observes it is the
-human in the loop. Adjacent hooks (`block-no-verify`) guard hook-bypass, not
-destructive intent; claiming them here would inflate coverage, so they are not
-claimed.
-
-So this rule is load-bearing **and** unenforced. It is carried by the model
-honouring it — which is why it is a kernel rule, why it is short, and why it is
-counted as uncovered in the enforcement-coverage report rather than excluded
-from it.
-
-## See also
-
-[`autonomous-execution`](autonomous-execution.md) · [`commit-policy`](commit-policy.md) · [`scope-control`](scope-control.md) · [`user-interaction`](user-interaction.md).

package/dist/agent-src/rules/onboarding-gate.md

@@ -14,10 +14,20 @@ enforced_by:
 
 # Onboarding Gate
 
-**Iron Law.** First turn of project: if `onboarding.onboarded` is false in `.agent-settings.yml`, instruct dev to run `agent-config setup` in terminal before any other request. Wizard writes `onboarding.onboarded: true` on `Finish` → rule silenced after.
+**Iron Law.** First turn of a project: if `onboarding.onboarded` is
+false in `.agent-settings.yml`, instruct the developer to run
+`agent-config setup` in their terminal before executing any other
+request. The wizard writes `onboarding.onboarded: true` on `Finish`,
+which silences this rule for subsequent turns.
 
-`agent-config setup` boots local TypeScript server (Fastify on `127.0.0.1`), opens browser wizard at `/#/wizard`. No chat-side skill — legacy `/onboard` and its `onboard:finish` bridge have been retired; browser wizard is sole onboarding surface.
+`agent-config setup` boots the local TypeScript server (Fastify on
+`127.0.0.1`) and opens the browser wizard at `/#/wizard`. The chat
+side has no equivalent skill — the legacy `/onboard` skill and its
+`onboard:finish` bridge have been retired; the browser wizard is the
+sole onboarding surface.
 
-Cloud surfaces without settings file stay inert: rule does not fire when `.agent-settings.yml` absent → headless / read-only contexts (Cloudflare MCP, doc preview, CI) never see prompt.
+Cloud surfaces without a settings file stay inert: the rule does not
+fire when `.agent-settings.yml` is absent, so headless / read-only
+contexts (Cloudflare MCP, doc preview, CI) never see the prompt.
 
-Trigger-set above activates routing on demand, independent of the discipline profile (ADR-110).
+Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/persona-governance.md

@@ -3,7 +3,7 @@ type: "auto"
 tier: "2a"
 description: "Creating/editing/proposing personas — enforce per-domain cap (≤ 2 specialists), ≥ 1 skill citation, deprecation path"
 triggers:
-  - path_prefix: ".agent-src.uncondensed/personas/"
+  - path_prefix: "src/agent-src/personas/"
   - path_prefix: "dist/agent-src/personas/"
   - keyword: "persona"
   - keyword: "personas"
@@ -46,6 +46,6 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 ## See also
 
 - [`docs/contracts/persona-schema.md`](../docs/contracts/persona-schema.md) — schema lock, tiers, sections, size budgets, linter enforcement surface, and the migrated governance checks (§ 8).
-- [`docs/personas.md`](../docs/personas.md) — active persona catalog, citation map, ownership column.
+- [`docs/personas.md`](../../docs/personas.md) — active persona catalog, citation map, ownership column.
 - [`ai-council`](../skills/ai-council/SKILL.md) — neutral second-opinion mechanism used for merge / deprecation decisions.
 - [`skill-quality`](skill-quality.md) — sibling discipline rule for skill files.

package/dist/agent-src/rules/php-coding.md

@@ -10,6 +10,7 @@ routes_to:
   - "guideline:php/php-coding-patterns"
 workspaces: [engineering]
 packs: [php]
+roles: [developer, reviewer]
 trust:
   level: professional
 install:

package/dist/agent-src/rules/prefer-enums-over-literals.md

@@ -2,7 +2,7 @@
 type: "auto"
 tier: "2b"
 alwaysApply: false
-description: "Modeling a field/property with multiple non-boolean states — prefer an enum over bare string/numeric literals; found old-style literals where an enum fits → note, finish the task, ask after"
+description: "Field with multiple non-boolean states — prefer an enum over string/numeric literals; old-style literals found → note, finish the task, ask after"
 triggers:
   - intent: "modeling a field with multiple states"
   - intent: "adding a status or type field"
@@ -17,7 +17,7 @@ packs: [engineering-base]
 
 # Prefer Enums Over Literal Values
 
-When a field/property holds **two or more non-boolean states** — strings (`'active'`, `'pending'`, `'archived'`) or meaningful numeric codes (priority `1`/`2`/`3`, tier levels) — model it as an **enum**, not a bare string/int. An enum names the value in code (readable), makes it greppable + safe to rename, gives exhaustiveness/typo safety, and makes filtering + editing relations far easier than raw literals scattered across the codebase.
+When a field or property can hold **two or more non-boolean states** — strings (`'active'`, `'pending'`, `'archived'`) or meaningful numeric codes (priority `1`/`2`/`3`, tier levels) — model it as an **enum**, not a bare string/int. An enum names the value in code (readable), makes the value greppable and safe to rename, gives exhaustiveness/typo safety, and makes filtering and editing relations far easier than raw literals scattered across the codebase.
 
 ## The Iron Law
 
@@ -35,26 +35,26 @@ FOUND OLD-STYLE LITERALS WHERE AN ENUM FITS? NOTE IT, FINISH THE TASK, THEN ASK
 
 ## Do NOT force an enum when
 
-- A boolean (`true`/`false`) — a flag, not an enum.
+- A boolean (`true`/`false`) — that's a flag, not an enum.
 - Open/unbounded free text — name, description, URL, comment.
 - A genuine numeric **quantity** used in arithmetic — price, count, age, bytes.
 - A set owned entirely by a volatile external system — unless you map it to your own enum at the boundary.
 
 ## How (framework-neutral)
 
-- Use the language's native construct: backed enum (PHP `enum Status: string`), string-literal union or `enum` (TypeScript), `enum.Enum` (Python), an enum/`CHECK`-constrained column or lookup table + FK (database).
+- Use the language's native construct: a backed enum (PHP `enum Status: string`), a string-literal union or `enum` (TypeScript), `enum.Enum` (Python), an enum/`CHECK`-constrained column or a lookup table + FK (database).
 - Persist the enum's backing value; reference the **named case** in code, never the raw literal.
 
 ## Found old-style literals where an enum fits — defer, do not disrupt
 
-Apply exactly this order so the current task's flow is never interrupted:
+The proactive part — apply exactly this order so the current task's flow is never interrupted:
 
-1. **While doing the actual task**, if you pass code using raw string/numeric literals for a multi-state field where an enum fits, do **NOT** refactor inline (a drive-by edit — see `minimal-safe-diff`) and do **NOT** stop to ask mid-flow.
+1. **While doing the actual task**, if you pass code using raw string/numeric literals for a multi-state field where an enum would be better, do **NOT** refactor it inline (that is a drive-by edit — see `minimal-safe-diff`) and do **NOT** stop to ask mid-flow.
 2. **Note the site** — file:line + the literal set — in your working notes.
-3. **After the actual task is delivered**, surface the noted candidates as **one** numbered-options prompt (per `user-interaction`): list each enum-candidate site, ask whether to replace — all / selected / none.
-4. **Only on an explicit yes** do you refactor, as a **separate change** with its own scope (`downstream-changes` applies — update every caller, migration, test, serializer).
+3. **After the actual task is delivered**, surface the noted candidates as **one** numbered-options prompt (per `user-interaction`): list each enum-candidate site, and ask whether to replace — all / selected / none.
+4. **Only on an explicit yes** do you refactor, and treat it as a **separate change** with its own scope (`downstream-changes` applies — update every caller, migration, test, serializer).
 
-If the task itself is *adding* the field, apply the enum from the start — no deferral; the defer-and-ask flow is only for pre-existing literals you encounter.
+If the task itself is *adding* the field, apply the enum from the start — no deferral needed; the defer-and-ask flow is only for pre-existing literals you happen to encounter.
 
 ## See also
 

package/dist/agent-src/rules/preservation-guard.md

@@ -52,7 +52,10 @@ want. What's forbidden is **deletion**: the rationale paragraph stays, the
 canonical-failure example stays, every "NEVER X" bullet stays.
 
 `scripts/check_condensation.ts` enforces these mechanically — any violation is
-an `error`, not a warning.
+an `error`, not a warning. Since ADR-201 it enforces them the strongest way
+available: byte-exactness between source and projection. Structural findings
+(lost heading, mangled fence, dropped passage) are retained as diagnostics that
+name *what* differs when the bytes do.
 
 ## Mandatory preservation checklist
 
@@ -86,7 +89,12 @@ Before completing any transformation, verify:
 - Skill merges (combining two skills into one)
 - Skill splits (extracting part of a skill)
 - Refactoring (restructuring without behavior change)
-- Condensation (`.agent-src.uncondensed/` → `dist/agent-src/`)
+- ~~Condensation (source tree → `dist/agent-src/`)~~ — **no longer applicable
+  (ADR-201, accepted 2026-07-29).** `.md` is copied verbatim and path-rewritten,
+  so the projection cannot drop a passage, downgrade an Iron Law heading, or
+  mangle a code block: `check_condensation` now asserts `dist == rewrite(src)`
+  byte-for-byte. The obligations below still bind every *authoring* transform in
+  this list — they simply have nothing left to police in the projection.
 - Rule consolidation
 - Guideline restructuring
 

package/dist/agent-src/rules/question-not-instruction.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "1"
-description: "A question is a request for an ANSWER, never authorization to act — answer first; never treat 'why…?' / 'can you…?' / 'what do you think?' as a green light to build, change, or execute"
+description: "A question requests an ANSWER, never authorization to act — answer first; 'why…?' / 'can you…?' is no green light to build, change, or execute"
 triggers:
   - phrase: "warum"
   - phrase: "wieso"

package/dist/agent-src/rules/reviewer-awareness.md

@@ -12,6 +12,7 @@ routes_to:
   - "skill:review-routing"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+roles: [reviewer]
 ---
 
 # Reviewer Awareness

package/dist/agent-src/rules/roadmap-ci-steps-policy.md

@@ -26,6 +26,7 @@ validator_ignore:
     reason: "Rule reads quality.local_auto_run from .agent-settings.yml; naming the file is the contract."
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+roles: [planner]
 ---
 
 # Roadmap CI-Steps Policy

package/dist/agent-src/rules/roadmap-progress-sync.md

@@ -11,6 +11,7 @@ routes_to:
   - "guideline:agent-infra/roadmap-progress-mechanics"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+roles: [planner]
 enforced_by:
   - "hook:roadmap-progress"
 ---
@@ -75,6 +76,12 @@ Before sending any reply that landed roadmap work:
 
 1. Did this reply land a step (code/doc saved + verification passed)?
 2. Is its checkbox flipped to `[x]` / `[~]` / `[-]` in `agents/roadmaps/<file>.md`? If no → flip, then continue.
+2b. Was a roadmap created or updated from an `agents/tmp/` inbox file this
+   reply? If yes → `mv` that file to `agents/tmp.old/` NOW, same reply (per
+   `agents-layout § User Inbox Workflow`), and point the roadmap's Source
+   line at `agents/tmp.old/<name>`. A consumed inbox file left in
+   `agents/tmp/` is a rule violation, not tidiness. Move ONLY the file(s)
+   explicitly named as input — never sweep the rest of the inbox.
 3. Is regen due now per `roadmap.dashboard_regen_cadence`?
    - `per_step` → yes, always.
    - `every_5_steps` → yes when this is the 5th, 10th, … closed step in the run, or the last step of the reply.

package/dist/agent-src/rules/rule-type-governance.md

@@ -3,7 +3,7 @@ type: "auto"
 tier: "2a"
 description: "Creating/editing rules, or auditing rule types — decides when a rule should be always vs auto"
 triggers:
-  - path_prefix: ".agent-src.uncondensed/rules/"
+  - path_prefix: "src/rules/"
 routes_to:
   - "guideline:agent-infra/rule-type-governance"
 workspaces: [agent-config-maintainer]

package/dist/agent-src/rules/scale-discipline.md

@@ -0,0 +1,92 @@
+---
+type: "auto"
+tier: "2a"
+description: "Scale-safe persistence — indexes with the queries, bounded reads, safe migrations, growth budgets, thin request path, durable async; heuristics advise"
+triggers:
+  - keyword: "migration"
+  - keyword: "index"
+  - keyword: "N+1"
+  - keyword: "eager load"
+  - keyword: "pagination"
+  - keyword: "queue"
+  - keyword: "job"
+  - keyword: "retention"
+  - keyword: "schema"
+  - keyword: "SELECT *"
+  - phrase: "will this scale"
+  - phrase: "review this migration"
+  - phrase: "add a table"
+  - phrase: "send an email on"
+routes_to:
+  - "skill:schema-review"
+workspaces: [engineering]
+packs: [scale-discipline]
+trust:
+  level: professional
+---
+
+# Scale Discipline
+
+Pack floor for the `scale-discipline` pack (default-off; auto-activates
+when the pack is installed). AI agents produce functionally correct but
+scale-hostile persistence code — this rule binds the failure classes to
+deterministic pattern lints where possible and to review advice where not.
+
+## The Iron Law
+
+```
+INDEXES SHIP WITH THE QUERIES THAT NEED THEM. READS ARE BOUNDED.
+MIGRATIONS ARE REVERSIBLE. APPEND-ONLY TABLES DECLARE RETENTION.
+THE SYNC HANDLER DOES ONLY: VALIDATE → PERSIST → DISPATCH → RESPOND.
+MUST-NOT-LOSE WORK GOES THROUGH A DURABLE QUEUE, AFTER COMMIT.
+A HEURISTIC FINDING IS ADVICE, NEVER A CI FAILURE.
+EVERY WAIVER CARRIES A NON-EMPTY REASON.
+```
+
+## Rule surface (tier per the spike-verdict record: `lint_persistence` gates where a spike PASSED; unspiked rules — R-A4, R-A9, R-A11 — are advice/normative only)
+
+- **R-A1 query-shape** — no query calls inside iteration over query
+  results; batch/eager-load instead (F1).
+- **R-A2 index-parity** — every FK and every WHERE/ORDER BY column has an
+  index or an explicit `// no-index: <reason>` waiver (F2).
+- **R-A3 bounded-reads** — list endpoints paginate or declare a bound; no
+  `SELECT *` on production paths (F3).
+- **R-A4 reference-over-copy** — new columns duplicating FK-reachable data
+  need a waiver (F4) — *advice tier*.
+- **R-A6 migration-safety** — reversible; NOT NULL needs a default;
+  concurrent index creation where the driver supports it; no destructive
+  op without a waivered reason (F6).
+- **R-A7 growth-budget** — append-only tables declare retention: TTL,
+  pruning job, partition rotation, or archive path (F7).
+- **R-A8 thin-request-path** — offloadable-catalog calls (mail, PDF/media,
+  third-party HTTP, bulk mutations, ML inference, outbound webhooks)
+  inside a request handler fail lint unless waived
+  `// sync-required: <reason>` (F9). The catalog is a positive list of
+  expensive call classes — a single indexed insert never needs a job.
+- **R-A9 event-decoupling** — side effects react to domain events or
+  observers via (queued) listeners; the mutating call site does not
+  enumerate its consumers (F10) — *advice tier*.
+- **R-A10 durable-async** — must-not-lose work (promised emails, billing,
+  audit fan-out) goes through a durable queue with retry/backoff and a
+  dead-letter path — never in-process fire-and-forget. No broker? Use a
+  DB-backed queue driver or a documented `// accepted-loss: <reason>`
+  waiver — never a silent in-process fallback (F11).
+- **R-A11 commit-ordering** — async dispatch that reads mutated state
+  fires after commit (Laravel `afterCommit` / `ShouldDispatchAfterCommit`;
+  generic: transactional outbox).
+
+## When NOT to fire
+
+- No persistence surface in the change (docs, UI-only, config).
+- Runtime performance analysis of live traffic — that is APM territory,
+  not artifact linting.
+
+## See also
+
+- [`schema-review`](../skills/schema-review/SKILL.md) — runs the linter,
+  emits the gap table + neutral waiver-density report.
+- [`history-discipline`](history-discipline.md) — sibling pack floor;
+  audit tables fall under R-A7 here.
+- [`architecture`](architecture.md) — thin handlers; this rule is its
+  persistence-shaped enforcement.
+- `src/scripts/lint_persistence.ts` — the deterministic backstop.

package/dist/agent-src/rules/scope-control.md

@@ -43,7 +43,7 @@ NEW TASK NEVER INHERITS PRIOR AUTONOMY.
 ARTIFACT SAVED → HARD STOP. NEVER AUTO-OFFER EXECUTION.
 ```
 
-`create / draft / write / erstelle …` → artifact only. Execution verbs flip scope; mixed → ask. The moment the artifact lands (roadmap, ADR, plan, pitch, ticket), the turn ends — never auto-offer execution; execution needs an explicit execution verb (`implement`, `build`, `start`, `arbeite ab`) on a later turn. Detail + anti-patterns: [`scope-mechanics`](../contexts/authority/scope-mechanics.md).
+`create / draft / write / erstelle …` → artifact only. Execution verbs flip scope; mixed → ask. The moment the artifact lands (roadmap, ADR, plan, pitch, ticket), the turn ends — never auto-offer execution. Execution requires an explicit execution verb (`implement`, `build`, `start`, `arbeite ab`) on a later turn. Detail + anti-pattern catalogue: [`scope-mechanics`](../contexts/authority/scope-mechanics.md).
 
 ## Production, infrastructure, bulk-destructive — Hard Floor
 

package/dist/agent-src/rules/secret-vcs-guard.md

@@ -2,7 +2,7 @@
 type: "auto"
 tier: "2a"
 alwaysApply: false
-description: "About to write a credential into a tracked file or stage/commit one in any VCS (git/svn/hg) — STOP, show the match, ask, offer alternatives; never silently commit, never silently strip"
+description: "Writing a credential into a tracked file or committing one in any VCS (git/svn/hg) — STOP, show the match, ask, offer alternatives; never silently"
 triggers:
   - intent: "writing a credential or API key into a file"
   - intent: "committing or staging changes that may contain a secret"

package/dist/agent-src/rules/security-sensitive-stop.md

@@ -16,13 +16,23 @@ validator_ignore:
     reason: "See-also routes to docs/threat-model.md — the canonical attack-surface doc lives there by design."
 workspaces: [engineering]
 packs: [engineering-base]
+enforced_by:
+  - "none"
 ---
 
 # Security-Sensitive Stop Rule
 
-Before editing any file that matches a security-sensitive surface, **stop and
-run a threat analysis first**. Shipping a security-sensitive change without a
-prior threat pass is the #1 driver of authorization and data-exposure bugs.
+## The Iron Law
+
+```
+A SECURITY-SENSITIVE SURFACE IS THREAT-MODELLED BEFORE THE FIRST EDIT, NEVER AFTER.
+STOP WRITING CODE. RUN THE MATCHING ANALYSIS SKILL. IMPLEMENT AGAINST ITS OUTPUT,
+NOT AGAINST YOUR FIRST INSTINCT.
+NEVER SILENTLY FALL BACK TO EDITING WITHOUT THE ANALYSIS — IF IT IS BLOCKED, ASK.
+```
+
+Shipping a security-sensitive change without a prior threat pass is the #1 driver
+of authorization and data-exposure bugs.
 
 ## What counts as security-sensitive
 
@@ -45,7 +55,7 @@ If the change touches any of these, the rule fires.
 
 ## What to do when it fires
 
-STOP writing code. Run the matching analysis skill first:
+Run the matching analysis skill first:
 
 | Change type | Analysis skill |
 |---|---|
@@ -70,10 +80,8 @@ A prior security incident on the same path is the cheapest possible
 input to a threat pass — cite any matching `id` in the analysis output
 so the required control or regression test ships with the fix.
 
-Capture the analysis output (abuse cases, missing controls, required
-negative tests) — implement against that list, not against your first
-instinct. Never silently fall back to editing without the analysis; if
-it is blocked, ask the user.
+Capture the analysis output — abuse cases, missing controls, required negative
+tests — and implement against that list.
 
 ## When NOT to fire
 
@@ -100,4 +108,12 @@ Authorization and tenancy bugs are often invisible in logs and fire silently
 until an auditor or attacker finds them. The cheapest moment to catch them
 is before the first edit — this rule makes that the default path.
 
+## Enforcement — stated honestly (`enforced_by: none`)
+
+No script can enforce "threat-model before you edit": the obligation is a
+pre-edit reasoning step only the model observes (ADR-135 classifies it HIGH —
+model-carried, honestly uncovered). Adjacent validators (`check_secret_leak`,
+`lint_agent_security`) cover neighbouring surfaces, not this stop — claiming
+them here would inflate coverage, so they are not claimed.
+
 See also: `threat-modeling` · `authz-review` · `data-flow-mapper` · `minimal-safe-diff` · `think-before-action` · [`untrusted-input-defense`](untrusted-input-defense.md) · [`lethal-trifecta-guard`](lethal-trifecta-guard.md) · [`secret-vcs-guard`](secret-vcs-guard.md) · [`docs/threat-model.md`](../../docs/threat-model.md).