@event4u/agent-config 9.8.0 → 9.10.0

package/docs/decisions/ADR-091-split-meta-capability-packs.md

@@ -1,113 +0,0 @@
----
-adr: 091
-status: accepted
-date: 2026-06-13
-decision: split-meta-capability-packs
-supersedes: —
-superseded_by: —
-phase: command-surface-refactor-residuals
-type: structural
----
-
-# ADR-091 — Split the `meta` pack into capability-scoped packs (logical re-tag)
-
-## Status
-
-**Accepted** · 2026-06-13. Decided by AI council (anthropic/claude-sonnet-4-5
-+ openai/gpt-4o, peer-review, deep) — converged on **logical re-tag, phased,
-memory-first**, and flagged the `council`/`challenge-me`/`grill-me`
-surface-map↔pack ontology mismatch as the real defect to fix.
-
-## Context
-
-`meta` was one capability pack owning the artefacts that maintain the package
-itself: **68 commands** (`pack: meta`) + **58 skills** (`packs: [meta]`),
-`artefact_count: 263`, `size_class: core`, `always_on: true`, `domain: meta`.
-A reviewer and the 6.1.0 roadmap (line 103) repeatedly asked to split it into
-capability-scoped packs; it was punted twice.
-
-Verified mechanism facts that shaped the decision:
-
-- Pack-manifest membership is the frontmatter `packs:` axis
-  (`generate_pack_manifests.py::_collect_flat` → `pid in fm['packs']`); the
-  per-pack visible-command budget groups by the canonical `pack:` owner.
-- Command **slugs are derived from the physical `src/domains/<pack>/<subpath>`
-  path**, independent of the `pack:`/`packs:` tags. A frontmatter re-tag
-  therefore changes ownership **without** changing any slug → no deprecation
-  aliases needed.
-- The discovery resolver's `always_on` seeding is vocabulary-driven
-  (`config/packs.always_on_packs`), not hard-coded to the string `meta`.
-- A **physical** re-parent hits real friction: an orchestrator-root command
-  (`/memory`, `/council`) lives at `src/domains/<pack>/<cluster>/command.md`
-  and cannot sit at a pack root (the activation gate rejects a bare
-  `src/domains/<pack>/command.md`), and `slug_prefix` only resolves for packs
-  homed under `src/domains/`. This is the hidden cost that stalled the split
-  twice.
-- The council's stated "budget violation (8.5×)" premise is **false**: the
-  68 are mostly tier-2 *internal* commands (uncapped); meta's *visible* count
-  is within its budget of 8 (`audit_command_surface.py --budget` → 0 over
-  budget). There is no CI-forcing function; the driver is capability clarity.
-
-## Decision
-
-**Logical re-tag.** Carve three cohesive capabilities out of `meta` by
-re-tagging command frontmatter (`pack:` + `packs:`) and adding the new pack
-ids to `src/config/discovery/packs.yml`. Command files stay physically under
-`src/domains/meta/<cluster>/` (no moves → no slug churn → no aliases); the new
-packs are homed under `src/packs/<id>/` like the other capability packs.
-
-New packs (all `workspaces: [agent-config-maintainer]`, `trust_level_default:
-core`, `always_on: false` — opt-in capabilities surfaced to the maintainer
-workspace):
-
-| Pack | Clusters carved out | size_class |
-|---|---|---|
-| `memory` | `memory`, `chat-history` | small |
-| `analytics` | `analytics`, `cost-report` | small |
-| `product-reasoning` | `council`, `challenge-me`, `grill-me` | medium |
-
-`meta` **stays** the `always_on` platform / agent-admin core pack (agents,
-mode, profile, override, sync-*, optimize, skill(s), condense, context,
-orchestrate, package-reset, set-cost-profile, upstream-contribute,
-review-routing, rule-compliance-audit, agent-handoff, agent-status,
-check-current-md) plus all 58 skills. `review-routing` +
-`rule-compliance-audit` (governance, 2 commands) stay folded into `meta`
-rather than a 2-command pack of their own.
-
-The `knowledge` cluster is intentionally **not** part of `memory`: it is
-already owned by `pack: product-discovery` (`src/domains/product-discovery/
-knowledge/`), not `meta`, so it is out of this split's scope.
-
-`product-reasoning` resolves the ontology bug: `council`/`challenge-me`/
-`grill-me` are classified `product` in `src/flows/surface-map.yaml` but were
-owned by `pack: meta`. They now have an owning capability pack.
-
-### Rejected / deferred
-
-- **Physical re-parent** (moving command dirs under `src/domains/<newpack>/`):
-  deferred — the orchestrator-root + `slug_prefix` friction above makes it a
-  separate, careful change with deprecation-alias cost, and the logical re-tag
-  already satisfies the acceptance criterion. Recorded as a follow-up.
-- **`governance` as its own pack**: rejected — 2 commands do not warrant a
-  budget unit; folded into `meta`.
-- **Big-bang full split** in one pass: rejected per the council's phased
-  guidance; executed memory-first as the proof, then analytics +
-  product-reasoning in the same change once the pipeline was proven green.
-
-## Consequences
-
-- The carved commands move from the `always_on` meta surface to opt-in
-  capability packs scoped to the `agent-config-maintainer` workspace; the
-  maintainer still resolves them via that workspace.
-- `meta`'s `artefact_count` drops; three new `pack.yaml` manifests are
-  generated; the discovery manifest gains the new pack tags.
-- Pack-dependency, budget, and marketplace lints stay green (verified).
-- Physical co-location of the carved commands under their new pack homes
-  remains a future, alias-bearing change.
-
-## References
-
-- `agents/roadmaps/archive/road-to-command-surface-refactor-residuals.md` — Phase 2.
-- `docs/contracts/capability-packs.md` — pack ownership + budget model.
-- `src/flows/surface-map.yaml` — the `product` classification reconciled here.
-- ADR-057 — consolidation-evidence-gate outcomes (physical folding out of scope).

package/docs/decisions/ADR-092-defer-command-tier-alias-removal.md

@@ -1,117 +0,0 @@
----
-adr: 092
-status: accepted
-date: 2026-06-13
-decision: defer-command-tier-alias-removal
-supersedes: —
-superseded_by: —
-phase: metadata-and-command-surface-leanness
-type: structural
----
-
-# ADR-092 — Defer the command `tier:` alias removal (close ADR-090 Option B as deferred-with-forcing-function)
-
-## Status
-
-**Accepted** · 2026-06-13. Decided by AI council (anthropic/claude-sonnet-4-5
-+ openai/gpt-4o, peer-review, deep) — converged on **defer**, with a
-forcing-function refinement: a defer without a re-open mechanism is
-abandonment in disguise.
-
-## Context
-
-[ADR-090](ADR-090-visibility-command-frontmatter-field.md) made `visibility:`
-the command-classifier source of truth and kept the integer `tier:` (`0/1/2`)
-as a back-compat alias, **deferring** the alias removal ("Option B") "once
-readers and the manifest have fully migrated". This ADR closes that deferred
-question with the Phase-3 investigation evidence.
-
-Investigation findings (`road-to-metadata-and-command-surface-leanness`, Phase 3):
-
-- **Integer-`tier` readers are internal:** `src/cli/commands/commands.ts`
-  (fallback after `visibility`), `src/scripts/audit_command_surface.ts`
-  (report column + budget fallback), `src/scripts/build_discovery_manifest.ts`
-  (**dual-emits `tier`** into the manifest). `src/cli/python/workspace_hosts.ts`
-  uses a semantically unrelated host-inventory tier.
-  <!-- paths updated 2026-07-12: every reader migrated to TS during the
-  completed ADR-200 py2ts migration; the original .py list is preserved in
-  git history. -->
-- **The discovery manifest is a published npm artifact** — `package.json`
-  `files` + `build:discovery` in `prepack` + `prepublishOnly:
-  check_release_includes_discovery.ts`. It dual-emits the integer `tier`.
-  **External npm consumers that read the integer key are unknown.**
-- The defer rests on a **Runtime Risk that cannot be ruled out** (a consumer
-  may register/branch on the integer `tier`), not on evidence that such a
-  consumer exists. Maximal caution by default.
-
-## Decision
-
-**Defer Option B.** Keep the `tier:` alias + the manifest dual-emit. Do not
-remove `tier:` now: the published manifest's external consumers are unknown,
-so the "unknown external consumers = hard stop" rule applies.
-
-The defer is a **waypoint, not an end state** — it ships with a re-open
-forcing function so it cannot calcify into permanent debt:
-
-1. **Re-open mechanism (one of):**
-   - **Versioned manifest** — publish `discovery-manifest` v2 *without* `tier`
-     alongside v1; v1 header carries `deprecated: true` + a `sunset` date;
-     after the soak window with no breakage reported, drop `tier`.
-   - **Evidence of zero external integer-`tier` reads** (manifest-fetch
-     telemetry / a documented "tier key deprecated" notice + soak).
-2. **Time-boxed review** — re-evaluate at the next minor-release planning (or
-   within 12 months, whichever is first), escalating to the maintainer with
-   pre-committed options (build the v2 mechanism · proceed · keep deferred).
-3. Execution of the removal itself is carried to
-   `road-to-tier-removal.md` (blocked on the mechanism above), not this ADR.
-
-### Rejected alternatives
-
-- **Accept now — drop `tier:` immediately.** Breaks the published-manifest
-  contract for unknown consumers with no migration window. Hard stop.
-- **Record the defer in the evidence note only, no ADR.** The re-open trigger
-  + escalation is *decision-level* content (who authorised the timeout, under
-  what gate it proceeds), not evidence — it belongs in a decision record. The
-  investigation evidence stays in
-  `agents/settings/contexts/tier-visibility-and-merge-evidence.md`.
-
-## Consequences
-
-- The `tier:` ⇄ `visibility:` dual-field persists during the deferral;
-  drift is mitigated by the `lint_command_tiers.ts` consistency check (when
-  both present, they must agree).
-- The removal is **cheaply reversible** if ever executed: restoring the `tier`
-  field is a manifest schema patch (< 1h to publish), far below the rollback
-  cost of a runtime or DB change — but reversibility does not lift the
-  unknown-consumer hard stop.
-- `road-to-tier-removal.md` institutionalises the trigger so the defer stays
-  visible in planning rather than becoming folklore.
-
-## Addendum (2026-07-12) — re-open mechanism mid-flight
-
-Recorded during `road-to-opt-decision-flips` Phase 2; not a re-litigation —
-this ADR's own forcing function is executing:
-
-- **All integer-`tier` readers are now TypeScript** (ADR-200 migration landed
-  on `main`; the reader list above updated in place).
-- **Re-open mechanism #1 shipped:** `build_discovery_manifest.ts` emits the
-  machine-readable `deprecations` block + `sunset` field announcing the
-  `tier` deprecation (road-to-tier-removal Phase 1). Verified in the
-  **released** artifact: npm `8.10.0` (published 2026-07-10) ships
-  `dist/discovery/discovery-manifest.json` with
-  `deprecations[0] = {key: tier, replacement: visibility, since: ADR-092,
-  sunset: null}`.
-- **Soak status:** the soak clock runs since publish; zero tier-related
-  breakage reports (issue sweep 2026-07-12). The unknown-external-consumer
-  hard stop is NOT lifted by the notice alone — the soak must elapse.
-- **Execution continues in `road-to-tier-removal.md`**, revived from
-  `later/` to active on 2026-07-12 with the soak evidence cited in its
-  banner (portfolio-consolidation Phase 2).
-
-## References
-
-- [ADR-090](ADR-090-visibility-command-frontmatter-field.md) — the deferred
-  Option B this ADR closes.
-- `docs/contracts/command-surface-tiers.md` — tier/visibility contract.
-- `agents/settings/contexts/tier-visibility-and-merge-evidence.md` —
-  consumer-investigation evidence.

package/docs/decisions/ADR-093-ai-council-config-user-global.md

@@ -1,117 +0,0 @@
----
-adr: 093
-status: superseded
-date: 2026-06-13
-decision: ai-council-config-user-global
-supersedes: —
-superseded_by: 104
-phase: ai-council-config-relocation
-type: structural
----
-
-# ADR-093 — Relocate the AI-council config to the user-global namespace
-
-## Status
-
-**Accepted** · 2026-06-13. **Partially superseded by
-[ADR-104](ADR-104-ai-council-config-global-only.md)** (2026-06-22): the
-user-global relocation stands, but the project-local override this ADR
-*kept* (precedence rule 2 in § Decision) is removed — the council is now
-**global-only** and never searches the project tree.
-
-Maintainer directive (standing, restated): the council is a per-developer
-facility and must be configured once, globally, not re-declared per
-project.
-
-## Context
-
-The council config (`.ai-council.yml`) was a **project-tracked** file at
-`agents/settings/.ai-council.yml`, checked into this repository (it held the
-maintainer's enabled members + `file:`/`env:` key references). Resolution was
-anchored on the project root (`council_cli.py:AI_COUNCIL_FILE = REPO_ROOT /
-"agents" / "settings" / ".ai-council.yml"`; `cmd_doctor.py` recomputed the
-same path).
-
-Three defects followed from the project-tracked layout:
-
-1. **Per-project, not per-developer.** A single developer who wants the
-   council everywhere had to drop the file into every project — exactly the
-   opposite of "configure once".
-2. **Commit / leak risk.** The config sat in the tracked tree of a public
-   package; only the `file:`/`env:` indirection (raw keys are refused by
-   `_validate_api_key_ref`) kept secrets out.
-3. **Silent unavailability.** On any surface without a project copy — cloud /
-   headless / a fresh checkout / a different worktree — resolution found
-   nothing and the council refused with "ai_council.enabled is false", even
-   when the developer had set it up. The raw API keys already lived in the
-   user-global namespace (`~/.event4u/agent-config/<provider>.key`, resolved
-   by `resolve_api_key`); only the config that points at them did not.
-
-The user-global namespace helper (`scripts/_lib/user_global_paths.py`,
-`event4u_root()` → `~/.event4u/agent-config/`, with the legacy
-`~/.config/agent-config/` read-fallback) already underpinned key resolution,
-so the config had a natural home there.
-
-## Decision
-
-**The council config is user-global by default.** A single
-`resolve_config_path(project_root)` in `scripts/ai_council/config.py` is the
-one place that decides which file is read, with this precedence
-(first match wins):
-
-1. `$AI_COUNCIL_CONFIG` — explicit absolute path (tests / power users);
-   honoured even when absent, so typos surface as "create it here".
-2. Project-local `<project_root>/agents/settings/.ai-council.yml` — a
-   consumer project that deliberately checks in its own config; overrides
-   the user-global file for that project only.
-3. User-global `~/.event4u/agent-config/settings/.ai-council.yml` (legacy
-   `~/.config/agent-config/` read-fallback) — the canonical default.
-
-When none exists, the resolver returns the user-global write target so
-callers' `.exists()` gate and "create it at …" messaging both point at the
-global location.
-
-`council_cli.py` and `cmd_doctor.py` both route through this resolver. The
-tracked `agents/settings/.ai-council.yml` is removed from the repository; the
-documented shape ships as `agents/templates/.ai-council.yml.example` to copy
-from. The maintainer's live config now lives at
-`~/.event4u/agent-config/settings/.ai-council.yml`.
-
-Project-local override is **kept** (not removed) so a consumer team can still
-pin a shared council config in their own repo — but it is no longer the
-default, and this package no longer ships one in its tracked tree.
-
-## Consequences
-
-- The council now resolves from the user-global file in every project,
-  worktree, and CWD — verified: a worktree with no project copy resolves
-  `~/.event4u/agent-config/settings/.ai-council.yml` and reports `members=2`.
-- No council config can be silently committed to this (or any consumer)
-  public repo by default.
-- `doctor council-cli` now names the user-global path in its
-  "no council config" / "config invalid" messaging.
-- The test suite is made hermetic via `EVENT4U_CONFIG_HOME` sandboxing so
-  it never reads the developer's real global config (it otherwise would,
-  now that "no project file" falls through to global).
-- **Not done here (follow-up):** auto-scaffolding the global file from the
-  example template during `agent-config` install/setup. Resolution +
-  manual/templated placement satisfy "the package always uses it"; an
-  installer step that writes the example to the global path when absent is
-  a nice-to-have tracked separately to keep `install.py` out of this diff.
-
-## Alternatives
-
-- **Global always wins, ignore project files.** Rejected — it would break a
-  consumer team's legitimately checked-in shared council config. Removing
-  this package's tracked copy already gives the maintainer global-everywhere
-  behaviour without taking the override away.
-- **Keep the file project-tracked, just gitignore it.** Rejected — still
-  per-project, still absent on fresh/cloud surfaces; does not deliver
-  "configure once per user".
-
-## References
-
-- Contract: [`docs/contracts/ai-council-config.md`](../contracts/ai-council-config.md) § File location.
-- `scripts/ai_council/config.py:resolve_config_path` — the resolver.
-- `scripts/_lib/user_global_paths.py` — user-global namespace + legacy fallback.
-- `agents/templates/.ai-council.yml.example` — the documented shape to copy.

package/docs/decisions/ADR-094-agent-memory-layer-removal.md

@@ -1,94 +0,0 @@
----
-adr: 094
-status: accepted
-date: 2026-06-14
-decision: agent-memory-layer-removal
-supersedes: —
-superseded_by: ADR-124 (engine-adoption interpretation only)
-phase: memory-layer-cleanup
-type: structural
----
-
-# ADR-094 — Remove the heavyweight agent-memory layer; keep file-first memory
-
-## Status
-
-**Accepted** · 2026-06-14. Resolved by three AI-council rounds
-(claude-sonnet-4-5 + gpt-4o) on 2026-06-14; maintainer-directed package
-optimization.
-
-## Context
-
-Engineering memory in this suite had **two layers**:
-
-- **Layer 1 — file-first (in this repo).** Curated YAML under
-  `agents/memory/<type>/` + agent-written `agents/memory/intake/*.jsonl`,
-  read through `scripts/memory_lookup.retrieve()`. Git-tracked, lintable,
-  redactable, vendor-neutral. No external infrastructure.
-- **Layer 2 — the `@event4u/agent-memory` companion package (separate repo).**
-  PostgreSQL + pgvector, an MCP server, Ebbinghaus decay, trust scoring, and
-  cross-project learning. Consumed optionally via a versioned cross-repo
-  contract; `scripts/memory_lookup.py` exposed an `operational_provider` seam,
-  `scripts/memory_status.py` probed for the package CLI, and the MCP tools
-  routed through it when "present".
-
-The package was unused, its integration roadmaps were already archived, and
-its external repository is being deleted. Native agent memory (Claude, Cursor)
-is improving on the exact axis — semantic cross-session recall — where the
-package competed, and its PostgreSQL + MCP runtime contradicted the suite's
-"no app runtime" positioning.
-
-## Decision
-
-1. **Remove Layer 2 entirely** from `agent-config` — the package binding and
-   the now-dead generic operational machinery it alone served:
-   `package_operational_provider` / `_cli_operational_provider`, the
-   `operational_provider` parameter, the `OperationalProvider` type, the
-   repo-vs-operational conflict rule, `Shadow` / `with_shadows` /
-   `shadowed_by`, the package-detection in `memory_status.py`, the MCP
-   `with_package` routing, and the `agent-memory-contract.md` contract doc.
-2. **Keep Layer 1** — file-first `retrieve()`, the `check_memory.py` redaction
-   gate, and the typed curated/intake store. This is *governance* (auditable,
-   portable, reviewable), a different job from native memory.
-3. **Simplify contract artefacts in-place, do not loudly break.** The internal
-   `retrieval-v1` schema + conformance suite were reduced to repo-only
-   (`source: "repo"`; no `operational` / `trust` / `shadowed_by`) rather than
-   version-bumped, because the only consumer (the package) is deleted.
-4. **Adopt MemSkill's write-time curation discipline** (Apache-2.0,
-   github.com/ViktorAxelsen/MemSkill) into the `memory-consolidation` skill —
-   dedupe before insert, split distinct facts, merge-and-preserve on update,
-   delete only on explicit contradiction, prefer no-op under uncertainty, skip
-   trivial/fleeting/speculative. The ML training/eval pipeline is **not**
-   adopted; MemSkill's own thesis (quality comes from write-time skills, not a
-   heavy storage substrate) reinforces the removal.
-
-## Consequences
-
-- One memory layer, file-backed, smaller surface, no infra prerequisite.
-- `memory_status.status()` is now a constant file-backend report; `health()`
-  still emits the v1 envelope shape so the MCP `memory_status` tool is stable.
-- No decay engine → committed memory is bounded manually (intake gitignored,
-  type narrowing, entry caps, archived-entry deletion — see
-  `road-to-memory-pipeline-consolidation.md`).
-- The memory ADR area (`docs/adrs/memory/`) is retired from
-  `audit_adr_coverage.py`; ADR 0001 there is marked superseded by this ADR.
-
-## Alternatives considered
-
-- **Freeze Layer 2 (leave inert).** Rejected — a dormant integration surface
-  advertising a capability the suite no longer has is misleading residue.
-- **Markdown-only (drop the YML layer too).** Rejected — the working
-  `retrieve()` machinery + the `check_memory.py` redaction gate are real
-  governance a schema-less markdown parser cannot cheaply replace; an 8-consumer
-  migration is untested risk for no gain (council, Option B).
-- **Revive Layer 2 later.** Gated: requires ≥2 funded consumer projects with a
-  named maintainer each + explicit PostgreSQL adoption.
-
-## References
-
-- `agents/roadmaps/archive/road-to-agent-memory-removal.md` — the executing roadmap (archived).
-- `agents/roadmaps/archive/road-to-memory-pipeline-consolidation.md` — follow-on
-  mining consolidation + size bounding.
-- `docs/adrs/memory/0001-consumer-side-snapshot.md` — superseded by this ADR.
-- `docs/guidelines/agent-infra/memory-access.md` — the surviving file-backed
-  retrieval contract.

package/docs/decisions/ADR-095-workspace-boundary-contract.md

@@ -1,108 +0,0 @@
----
-adr: 095
-status: accepted
-date: 2026-06-14
-decision: workspace-boundary-contract
-supersedes: —
-superseded_by: —
-phase: v6.0.0 · final-readiness · Phase 4
-type: structural
----
-
-# ADR-095 — Workspace boundary contract + import-edge drift check
-
-## Status
-
-**Accepted** · 2026-06-14. Lands Phase 4 of
-[`road-to-6.0.0-final-readiness`](../../agents/roadmaps/archive/road-to-6.0.0-final-readiness.md).
-Routed through the AI council (anthropic/claude-sonnet-4-5 + openai/gpt-4o,
-design mode, 2026-06-14; converged 2-round on "import-boundary linter as MVP
-with explicit semantic-drift disclaimer + escape-hatch").
-
-## Context
-
-The PR #489 / 6.0.0 review flagged that **"workspace" risks becoming the new
-"meta"** — a catch-all that absorbs every nearby concern until it owns
-everything and means nothing. The workspace is real and load-bearing (13
-`src/cli/python/workspace_*.py` modules behind `/work` and the host-drive
-loop), so the risk is concrete: a future change quietly teaches a workspace
-module to design skills, decide profile semantics, or pick video providers,
-and the boundary erodes one import at a time.
-
-The prior council finding (#3 on the parent roadmap) accepted a boundary
-contract **with modification**: this repo has no dependency-cruiser /
-TS-import-boundary tooling, so any drift mechanism must *fit the real surface*
-or *explicitly justify doc-governance-only*.
-
-## Decision
-
-1. **Author a boundary contract** at
-   [`docs/contracts/workspace-boundary.md`](../contracts/workspace-boundary.md)
-   enumerating what the workspace **owns** and **does not own**.
-2. **Drift mechanism = an import-edge linter** (`scripts/lint_workspace_boundary.py`),
-   AST-static, over `src/cli/python/workspace_*.py`. It fails if a workspace
-   module imports an owner-module of a *not-owned* domain. It is wired into CI.
-3. **Explicit scope disclaimer.** The linter enforces **import edges only**.
-   Semantic drift — a workspace module encoding profile semantics or analytics
-   *product strategy* without importing anything forbidden — is **not**
-   catchable by an import check and stays **doc-governance**, enforced in
-   review against the contract. The contract states this limit plainly so the
-   green check is never mistaken for "the boundary is fully enforced" (the
-   council's named false-confidence risk).
-4. **Escape hatch.** A `# boundary-exception: <reason>` pragma on the import
-   line lets a justified, reviewed exception through; the contract records that
-   such pragmas are reviewed like any boundary change.
-
-### Owns / does-not-own (locked by the parent roadmap's council)
-
-| Workspace **owns** | Workspace **does NOT own** |
-|---|---|
-| task orchestration | skill design |
-| host-session lifecycle | profile semantics |
-| continuation (multi-turn) | video-provider logic |
-| drive health | MCP-registry policy |
-| | analytics **product strategy** |
-
-## Consequences
-
-- The boundary becomes a CI gate, not a wish-list. Day-one state: **zero
-  violations** (survey below), so the check locks the current-correct boundary
-  rather than papering over drift.
-- The import check is cheap and precise here because workspace modules live in
-  `src/cli/python/` and the not-owned owner-modules live in `src/scripts/` —
-  separate namespaces, no false-positive surface (workspace modules import only
-  stdlib, third-party `keyring`/`cryptography`/`yaml`, and intra-workspace
-  `workspace_*`).
-- Semantic drift remains a review responsibility; the contract names it so
-  reviewers know the linter is a supplement, not a substitute.
-
-## Survey — existing violations
-
-AST import survey of all 13 `workspace_*.py` modules (2026-06-14):
-
-- The only cross-module import is `workspace_inbox → workspace_skills`
-  (intra-workspace; allowed).
-- **Zero** imports of any skill-design / profile / pack / video / MCP /
-  condense / router / persona owner-module.
-- `workspace_skills.py` *resolves* skill bodies for host hand-off (consumes,
-  does not design) → within bounds.
-- `workspace_analytics.py` records task completion/abandonment telemetry
-  (drive-health domain, not analytics product strategy) → within bounds.
-
-**Result: zero boundary violations recorded.**
-
-## Alternatives
-
-- **Doc-governance-only (no check).** Rejected as the sole mechanism: the
-  surface is concrete Python with clean namespaces, so the cheapest lock (an
-  import check) earns its keep against the most common drift vector. Kept as
-  the mechanism for *semantic* drift, which an import check cannot see.
-- **dependency-cruiser / TS import-boundary tooling.** N/A — the workspace
-  surface is Python, not TS; importing JS tooling for it is wrong-stack.
-
-## References
-
-- [`docs/contracts/workspace-boundary.md`](../contracts/workspace-boundary.md) — the contract.
-- [`scripts/lint_workspace_boundary.py`](../../src/scripts/lint_workspace_boundary.py) — the drift check.
-- [`ADR-050`](ADR-050-workspace-vs-package-root-boundary.md) — the workspace-vs-package-root trust boundary this refines at the module level.
-- [`docs/contracts/daily-workspace.md`](../contracts/daily-workspace.md) — cross-links this contract.

package/docs/decisions/ADR-096-analysis-workbench.md

@@ -1,110 +0,0 @@
----
-adr: 096
-status: accepted
-date: 2026-06-15
-decision: analysis-workbench
-supersedes: —
-superseded_by: —
-phase: road-to-analysis-workbench · Phase 0
-type: structural
----
-
-# ADR-096 — Analysis Workbench design decisions
-
-## Status
-
-**Accepted** · 2026-06-15. Lands Phase 0 of
-[`road-to-analysis-workbench`](../../agents/roadmaps/archive/road-to-analysis-workbench.md).
-Routed through AI council (anthropic/claude-sonnet-4-5 + openai/gpt-4o,
-two rounds, 2026-06-15).
-
-## Context
-
-A new `analysis-workbench` pack was proposed to close the post-incident
-learning loop: structured post-mortem → root-cause analysis → corrective-action
-design → memory candidates → human-gated promote. Several design questions
-required council input before authoring any skill.
-
-## Decision
-
-### D1 — Collapse the skill set
-
-Council converged on four skills for v1:
-
-| Skill | Purpose |
-|---|---|
-| `blameless-post-mortem` | Structured post-incident review |
-| `root-cause-frameworks` | RCA engine (5-whys, fishbone, fault-tree, STAMP) |
-| `premortem` | Pre-launch risk elicitation |
-| `decision-review` | Retrospective decision quality |
-
-`incident-pattern-analysis` is **deferred** — it needs cross-project data the
-memory layer does not yet support reliably.
-
-### D2 — Internal-skill-heavy, not command-heavy
-
-The pack surfaces ≤ 5 visible commands (all opt-in). Complex orchestration
-lives inside skill bodies, not in a command DSL or state-machine orchestrator
-(deferred).
-
-### D3 — `/analyze` as confidence-weighted suggester, not auto-triage
-
-`/analyze` proposes candidate flows with confidence weights. The user picks.
-It does NOT auto-triage or auto-route. Selection choices are logged to the
-provisional intake stream so future iterations can tune weights from real usage.
-
-### D4 — Memory loop is manual; promote gate is inviolable
-
-The hardest pushback in both council rounds was against any auto-promote path.
-Decision: the loop produces and proposes; `scripts/check_memory_proposal.py`
-is the sole admission gate (≥2 distinct paths OR ≥3 future decisions);
-the human runs `/memory promote`. No skill, hook, or roadmap step may
-bypass this gate. See [`analysis-memory-loop.md`](../contracts/analysis-memory-loop.md).
-
-### D5 — AI-specific RCA deferred
-
-AI-specific failure modes (prompt injection, model hallucination root-cause,
-latency regression attribution) require `road-to-security-hardening` primitives
-that do not yet exist. Deferred explicitly; `root-cause-frameworks` ships
-without them.
-
-### N1 — Time-decay is a Phase 1 hardening item (adopted)
-
-Council named time-decay, supersession, and dedup pre-check as Phase 1 work
-(not blockers for Phase 0 contract authoring). The contract captures the
-schema now so Phase 1 has a stable target:
-
-- `last_validated` + `review_after_days` + `applicable_scope` on every candidate.
-- `retrieve()` returns `{results, skipped}` — stale entries are in `skipped`,
-  never silently included in `results`.
-- Dedup: `retrieve()` before draft; on match, propose `frequency`/`supersedes`
-  update, not a new entry.
-
-## Consequences
-
-- Phase 0 ships two authoring artifacts: `docs/contracts/analysis-memory-loop.md`
-  and this ADR. No skills, no code.
-- Phase 1 (memory-loop hardening) implements the schema fields and `retrieve()`
-  contract documented in `analysis-memory-loop.md` § 1 and § 4.
-- The pack uses pack identifier `analysis-workbench`, `size_class: medium`,
-  `cross_workspace: true`.
-- Domain adoption gates do not fire: the analysis domain is already open
-  (`incident-commander`, `risk-officer`, `decision-record`,
-  `systematic-debugging` exist in the suite).
-
-## Alternatives
-
-- **Auto-promote on ≥ 2 occurrences** — rejected both rounds. Silent learning
-  loop is a trust and auditability risk; human gate is non-negotiable.
-- **State-machine orchestrator** — deferred. Premature before skills ship and
-  real usage patterns emerge.
-- **`incident-pattern-analysis` in v1** — rejected. Needs cross-project memory
-  access not available in v1; deferred to a follow-up roadmap.
-- **Flat command surface (>5 commands)** — rejected per command-surface-tiers
-  contract; opt-in pack stays lean.
-
-## References
-
-- [`docs/contracts/analysis-memory-loop.md`](../contracts/analysis-memory-loop.md) — the loop contract.
-- [`docs/contracts/low-impact-corpus-format.md`](../contracts/low-impact-corpus-format.md) — curated memory schema.
-- [`ADR-094`](ADR-094-agent-memory-layer-removal.md) — agent memory layer decision this pack operates within.