@event4u/agent-config 9.8.0 → 9.10.0

package/src/scripts/encoding_corpus_report.ts

@@ -0,0 +1,216 @@
+#!/usr/bin/env tsx
+/**
+ * Measure the encoding floor against the FROZEN corpus
+ * (road-to-runtime-encoding-hardening Phase 4).
+ *
+ * Renders the numbers from the corpus — never hand-typed — and evaluates them
+ * against the thresholds the roadmap pre-registered BEFORE the detector existed:
+ *
+ *   recall on in-scope positives            >= 0.95
+ *   recall on unambiguous classes           >= 0.99
+ *     (zero-width, bidi, variation-selector)
+ *   false-positive rate on clean negatives  <= 0.005
+ *   added runtime model spend               == 0   (structural: no model call)
+ *   added latency                           <  2 ms p95 per message
+ *
+ * A positive counts as DETECTED when the floor either strips its signal
+ * (`sanitize_text` changed the value) or reports it (`scan_encoding_findings`
+ * returned a finding). Both are "the vector did not reach the model unnoticed",
+ * which is the property under test.
+ *
+ * Usage:
+ *     encoding_corpus_report            # human summary + exit 1 if a gate fails
+ *     encoding_corpus_report --json     # machine payload
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { OUT_DIR, type CorpusEntry } from './encoding_corpus.js';
+import { sanitize_text, scan_encoding_findings } from './_lib/retrieval_sanitize.js';
+
+/** Pre-registered acceptance thresholds — do not edit to make a run pass. */
+export const THRESHOLDS = {
+    recall_all: 0.95,
+    recall_unambiguous: 0.99,
+    fp_rate_max: 0.005,
+    latency_p95_ms_max: 2,
+} as const;
+
+/** Classes the roadmap singled out as unambiguous → higher recall bar. */
+export const UNAMBIGUOUS_CHANNELS: readonly string[] = [
+    'zero-width',
+    'zero-width-joiner-bom',
+    'bidi-control',
+    'variation-selector-run',
+];
+
+function _readJsonl(name: string): CorpusEntry[] {
+    return fs
+        .readFileSync(path.join(OUT_DIR, name), 'utf-8')
+        .split('\n')
+        .filter((l) => l !== '')
+        .map((l) => JSON.parse(l) as CorpusEntry);
+}
+
+/** True when the floor either stripped or reported the entry's signal. */
+export function detected(text: string): { hit: boolean; stripped: boolean; flagged: boolean } {
+    const stripped = sanitize_text(text) !== text;
+    const flagged = scan_encoding_findings(text).length > 0;
+    return { hit: stripped || flagged, stripped, flagged };
+}
+
+export interface Report {
+    readonly corpus: { positives: number; negatives: number };
+    readonly recall_all: number;
+    readonly recall_unambiguous: number;
+    readonly fp_rate: number;
+    readonly per_channel: Record<string, { n: number; detected: number; recall: number }>;
+    readonly false_positives: readonly string[];
+    readonly latency_p95_ms: number;
+    readonly model_calls: 0;
+    readonly gates: Record<string, { value: number; threshold: number; pass: boolean }>;
+    readonly verdict: 'ADOPT' | 'DETECT-AND-FLAG-ONLY' | 'FAIL';
+}
+
+function _p95(samples: readonly number[]): number {
+    const sorted = [...samples].sort((a, b) => a - b);
+    const idx = Math.min(sorted.length - 1, Math.floor(sorted.length * 0.95));
+    return sorted[idx] ?? 0;
+}
+
+export function measure(): Report {
+    const positives = _readJsonl('positives.jsonl');
+    const negatives = _readJsonl('negatives.jsonl');
+
+    const perChannel: Record<string, { n: number; detected: number; recall: number }> = {};
+    const latencies: number[] = [];
+    let hits = 0;
+    for (const e of positives) {
+        const t0 = process.hrtime.bigint();
+        const d = detected(e.text);
+        latencies.push(Number(process.hrtime.bigint() - t0) / 1e6);
+        const slot = perChannel[e.channel] ?? { n: 0, detected: 0, recall: 0 };
+        slot.n += 1;
+        if (d.hit) {
+            slot.detected += 1;
+            hits += 1;
+        }
+        slot.recall = slot.detected / slot.n;
+        perChannel[e.channel] = slot;
+    }
+
+    const falsePositives: string[] = [];
+    for (const e of negatives) {
+        const t0 = process.hrtime.bigint();
+        const d = detected(e.text);
+        latencies.push(Number(process.hrtime.bigint() - t0) / 1e6);
+        if (d.hit) falsePositives.push(`${e.id}: ${e.text.slice(0, 90)}`);
+    }
+
+    const unambiguous = positives.filter((e) => UNAMBIGUOUS_CHANNELS.includes(e.channel));
+    const unambiguousHits = unambiguous.filter((e) => detected(e.text).hit).length;
+
+    const recallAll = positives.length === 0 ? 0 : hits / positives.length;
+    const recallUnambiguous = unambiguous.length === 0 ? 0 : unambiguousHits / unambiguous.length;
+    const fpRate = negatives.length === 0 ? 0 : falsePositives.length / negatives.length;
+    const p95 = _p95(latencies);
+
+    const gates = {
+        recall_all: { value: recallAll, threshold: THRESHOLDS.recall_all, pass: recallAll >= THRESHOLDS.recall_all },
+        recall_unambiguous: {
+            value: recallUnambiguous,
+            threshold: THRESHOLDS.recall_unambiguous,
+            pass: recallUnambiguous >= THRESHOLDS.recall_unambiguous,
+        },
+        fp_rate: { value: fpRate, threshold: THRESHOLDS.fp_rate_max, pass: fpRate <= THRESHOLDS.fp_rate_max },
+        latency_p95_ms: {
+            value: p95,
+            threshold: THRESHOLDS.latency_p95_ms_max,
+            pass: p95 < THRESHOLDS.latency_p95_ms_max,
+        },
+    };
+
+    // The roadmap's pre-registered branch: recall clears but FP is over budget →
+    // ship detect-and-flag only, never automatic quarantine, and publish the FP
+    // number. Nothing here quarantines anyway, so this records which branch the
+    // measurement selected rather than switching behaviour after the fact.
+    const recallOk = gates.recall_all.pass && gates.recall_unambiguous.pass;
+    const verdict: Report['verdict'] = !recallOk
+        ? 'FAIL'
+        : gates.fp_rate.pass && gates.latency_p95_ms.pass
+          ? 'ADOPT'
+          : 'DETECT-AND-FLAG-ONLY';
+
+    return {
+        corpus: { positives: positives.length, negatives: negatives.length },
+        recall_all: recallAll,
+        recall_unambiguous: recallUnambiguous,
+        fp_rate: fpRate,
+        per_channel: perChannel,
+        false_positives: falsePositives,
+        latency_p95_ms: p95,
+        model_calls: 0,
+        gates,
+        verdict,
+    };
+}
+
+function _render(r: Report): string {
+    const pct = (n: number): string => (n * 100).toFixed(2) + '%';
+    const lines: string[] = [];
+    lines.push(`corpus: ${r.corpus.positives} positives · ${r.corpus.negatives} negatives`);
+    lines.push('');
+    lines.push('per-channel recall');
+    for (const [ch, s] of Object.entries(r.per_channel).sort()) {
+        const mark = s.recall === 1 ? '  ' : '!!';
+        lines.push(`  ${mark} ${ch.padEnd(24)} ${s.detected}/${s.n}  ${pct(s.recall)}`);
+    }
+    lines.push('');
+    for (const [name, g] of Object.entries(r.gates)) {
+        const cmp = name === 'fp_rate' || name === 'latency_p95_ms' ? '<=' : '>=';
+        const val = name === 'latency_p95_ms' ? `${g.value.toFixed(3)} ms` : pct(g.value);
+        const thr = name === 'latency_p95_ms' ? `${g.threshold} ms` : pct(g.threshold);
+        lines.push(`  ${g.pass ? 'PASS' : 'FAIL'}  ${name.padEnd(20)} ${val} ${cmp} ${thr}`);
+    }
+    lines.push(`  PASS  ${'model_calls'.padEnd(20)} 0 (structural: no model call on this path)`);
+    if (r.false_positives.length > 0) {
+        lines.push('');
+        lines.push(`false positives (${r.false_positives.length}):`);
+        for (const fp of r.false_positives.slice(0, 12)) lines.push(`  - ${fp}`);
+        if (r.false_positives.length > 12) {
+            lines.push(`  … ${r.false_positives.length - 12} more`);
+        }
+    }
+    lines.push('');
+    lines.push(`verdict: ${r.verdict}`);
+    return lines.join('\n') + '\n';
+}
+
+export function main(argv: readonly string[] | null = null): number {
+    const args = argv ?? process.argv.slice(2);
+    const r = measure();
+    if (args.includes('--json')) {
+        process.stdout.write(JSON.stringify(r, null, 2) + '\n');
+    } else {
+        process.stdout.write(_render(r));
+    }
+    return r.verdict === 'FAIL' ? 1 : 0;
+}
+
+declare const __AGENT_CONFIG_BUNDLE__: boolean | undefined;
+function _isCliEntry(): boolean {
+    if (typeof __AGENT_CONFIG_BUNDLE__ !== 'undefined' && __AGENT_CONFIG_BUNDLE__) return false;
+    if (process.argv[1] === undefined) return false;
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) return true;
+    try {
+        return fs.realpathSync(fileURLToPath(import.meta.url)) === fs.realpathSync(path.resolve(process.argv[1]));
+    } catch {
+        return false;
+    }
+}
+
+if (_isCliEntry()) {
+    process.exitCode = main();
+}

package/src/scripts/evaluator_umbrella.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# evaluator_umbrella.sh — the external evaluator's "first five minutes" as
+# ONE suite over the PACKED artifact (road-to-credible-install Phase 6).
+#
+# Runs in a clean container (see .github/workflows/evaluator-umbrella.yml)
+# on every release PR and nightly — never against the checkout's working
+# tree: every check below exercises the tarball `npm pack` produces or the
+# clean consumer install made from it.
+#
+# Checks (each individually red-testable via its own gate/tests):
+#   1. audit gate           npm audit --omit=dev --audit-level=high
+#   2. tarball integrity    publint + prepack script-target assertion
+#                           (lifecycle gate: tests/scripts/prepack_lifecycle_check.test.ts)
+#   3. headless install     npm install --omit=dev <tarball> in a scratch project
+#   4. staleness lints      lint_pre_migration_refs (+ consumer-internal refs
+#                           lint when present)
+#   5. hook-latency bench   bench_hook_latency --gate (budget + regression)
+#   6. cold-start budgets   CLI --version, mcp-server boot-to-initialize
+#   7. size budgets         unpacked, node_modules, dep count (>10% regression
+#                           fails even under budget)
+#   8. surface budgets      CLI registry command count, MCP tools/list count
+#                           (frozen post-Phase-3 values, ADR-132: 19)
+#   9. npx smoke            first-touch paths (--version, --help, mcp initialize)
+#   6-8 feed src/scripts/check_evaluator_budgets.ts against
+#   src/config/evaluator-budgets.json (owner + review date lint-enforced).
+#
+# Usage: bash src/scripts/evaluator_umbrella.sh [--skip-pack <tarball>]
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT"
+
+TARBALL=""
+if [[ "${1:-}" == "--skip-pack" && -n "${2:-}" ]]; then
+  TARBALL="$2"
+fi
+
+step() { printf '\n=== umbrella: %s ===\n' "$1"; }
+
+# ---------------------------------------------------------------- 1. audit
+step "npm audit (runtime deps, high+)"
+npm audit --omit=dev --audit-level=high
+
+# ------------------------------------------------------------- 2. pack + shape
+if [[ -z "$TARBALL" ]]; then
+  step "npm pack (prepack chain: build + discovery + manifest + prepack-check)"
+  TARBALL="$(npm pack --silent | tail -1)"
+else
+  step "using pre-packed tarball: $TARBALL"
+fi
+[[ -f "$TARBALL" ]] || { echo "❌ tarball missing: $TARBALL" >&2; exit 1; }
+
+step "publint (published-package shape)"
+npm run lint:publint --silent
+
+# `--ignore-scripts` is NOT honoured for `prepare` by every npm version: on the
+# node-20 container npm still runs it, and this repo's prepare installs the git
+# hooks and prints a banner — straight into the `--json` stdout we parse. Slice
+# from the first `[` so any lifecycle banner ahead of the payload is tolerated
+# instead of turning into `SyntaxError: Unexpected token '✅'`.
+UNPACKED_BYTES="$(npm pack --dry-run --json --ignore-scripts --silent 2>/dev/null \
+  | node -e 'let b="";process.stdin.on("data",c=>b+=c).on("end",()=>{const i=b.indexOf("[");const j=JSON.parse(i>=0?b.slice(i):b);console.log(j[0].unpackedSize)})')"
+
+# ------------------------------------------------------- 3. headless install
+step "headless consumer install from the tarball"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+( cd "$WORK" && npm init -y >/dev/null 2>&1 \
+  && npm install --omit=dev --no-audit --no-fund --silent "$ROOT/$TARBALL" )
+PKG_DIR="$WORK/node_modules/@event4u/agent-config"
+[[ -d "$PKG_DIR" ]] || { echo "❌ install did not produce the package dir" >&2; exit 1; }
+
+# --------------------------------------------------------- 4. staleness lints
+step "staleness lints (pre-migration refs)"
+./scripts-run src/scripts/lint_pre_migration_refs
+if [[ -f src/scripts/lint_consumer_internal_refs.ts ]]; then
+  ./scripts-run src/scripts/lint_consumer_internal_refs
+fi
+
+# ------------------------------------------------------ 5. hook-latency bench
+step "hook-latency bench (pre-registered budget gate)"
+./scripts-run src/scripts/bench_hook_latency --gate
+
+# ----------------------------------------------- 6-8. measured budget metrics
+step "cold-start + size + surface measurements"
+MEASURE_TMP="$WORK/measurements.json"
+CLI_BIN="$WORK/node_modules/.bin/agent-config"
+
+CLI_MS="$(node -e '
+const {execFileSync}=require("node:child_process");
+const t=Date.now();
+execFileSync(process.argv[1],["--version"],{stdio:"ignore"});
+console.log(Date.now()-t);' "$CLI_BIN")"
+
+MCP_MS="$(node -e '
+const {spawnSync}=require("node:child_process");
+const t=Date.now();
+const p=spawnSync("node",[process.argv[1]+"/dist/mcp/server.mjs"],{input:JSON.stringify({jsonrpc:"2.0",id:1,method:"initialize",params:{protocolVersion:"2024-11-05",capabilities:{},clientInfo:{name:"p",version:"0"}}})+"\n",encoding:"utf-8",timeout:30000});
+if(!(p.stdout||"").includes("serverInfo")){console.error(p.stderr);process.exit(1)}
+console.log(Date.now()-t);' "$PKG_DIR")"
+
+NM_MB="$(du -sm "$WORK/node_modules" | awk '{print $1}')"
+DEP_COUNT="$(node -e '
+const j=require(process.argv[1]);
+console.log(Object.keys(j.packages||{}).length-1);' "$WORK/package-lock.json")"
+
+CLI_COUNT="$(node -e '
+const fs=require("node:fs");
+const t=fs.readFileSync(process.argv[1],"utf-8");
+console.log((t.match(/\{ name: /g)||[]).length);' "$ROOT/src/cli/registry.ts")"
+
+MCP_TOOLS="$(node -e '
+const {spawnSync}=require("node:child_process");
+const reqs=[{jsonrpc:"2.0",id:1,method:"initialize",params:{protocolVersion:"2024-11-05",capabilities:{},clientInfo:{name:"p",version:"0"}}},{jsonrpc:"2.0",method:"notifications/initialized"},{jsonrpc:"2.0",id:2,method:"tools/list"}];
+const p=spawnSync("node",[process.argv[1]+"/dist/mcp/server.mjs"],{input:reqs.map(r=>JSON.stringify(r)).join("\n")+"\n",encoding:"utf-8",timeout:30000});
+const lines=(p.stdout||"").trim().split("\n").map(l=>{try{return JSON.parse(l)}catch{return null}}).filter(Boolean);
+const resp=lines.find(l=>l.id===2);
+if(!resp||!resp.result||!Array.isArray(resp.result.tools)){console.error("no tools/list result");process.exit(1)}
+console.log(resp.result.tools.length);' "$PKG_DIR")"
+
+node -e '
+const fs=require("node:fs");
+const m={
+  unpacked_size_mb: Number(process.argv[2])/1e6,
+  node_modules_mb: Number(process.argv[3]),
+  runtime_dep_count: Number(process.argv[4]),
+  cli_version_cold_ms: Number(process.argv[5]),
+  mcp_boot_to_initialize_ms: Number(process.argv[6]),
+  cli_help_command_count: Number(process.argv[7]),
+  mcp_public_tool_count: Number(process.argv[8]),
+};
+fs.writeFileSync(process.argv[1], JSON.stringify(m, null, 2));
+console.log(JSON.stringify(m, null, 1));' \
+  "$MEASURE_TMP" "$UNPACKED_BYTES" "$NM_MB" "$DEP_COUNT" "$CLI_MS" "$MCP_MS" "$CLI_COUNT" "$MCP_TOOLS"
+
+step "budget gate (absolute + >regression_pct creep)"
+./scripts-run src/scripts/check_evaluator_budgets --measurements "$MEASURE_TMP"
+
+# ------------------------------------------------------------- 9. npx smoke
+step "first-touch smoke (installed bin)"
+"$CLI_BIN" --version >/dev/null
+"$CLI_BIN" --help >/dev/null
+
+echo
+echo "✅  evaluator umbrella green — the first five minutes hold on the packed artifact."

package/src/scripts/external_sources_denylist.json

@@ -91,15 +91,17 @@
     "agents/roadmaps/archive/road-to-final-state-and-market-readiness.md",
     "agents/roadmaps/archive/road-to-image-brand-typography.md",
     "agents/roadmaps/archive/road-to-subagent-value-realization.md",
-    "agents/roadmap-assets/road-to-image-brand-typography.assets.md"
+    "agents/roadmap-assets/road-to-image-brand-typography.assets.md",
+    "CREDITS.md",
+    "agents/roadmaps/archive/road-to-ecosystem-harvest-index.md"
   ],
   "skip_reason": {
-    "vendored_cluster": "design-intelligence/corpus-grounding/design-tokens/react-shadcn-ui/tailwind-engineer + cost/*.mjs ship vendored Apache/MIT code; their upstream attribution is license-required and must NOT be stripped (ADR-061).",
+    "vendored_cluster": "design-intelligence/corpus-grounding/design-tokens/react-shadcn-ui/tailwind-engineer + cost/*.mjs ship vendored Apache/MIT code; their upstream attribution is license-required and must NOT be stripped (ADR-061). CREDITS.md is the repo-level attribution file FOR that same cluster — it names the upstreams because the licenses require it, which is the one case source-confidentiality explicitly exempts. It was missing here, so the gate flagged the very attribution the rule mandates.",
     "recommendation_docs": "mcp.md, mcp-registries.md, DISTRIBUTION_CHECKLIST.md, ADR-086, marketing-copy.yml reference registries (Smithery/Glama) as recommendations/distribution targets — allowed.",
     "generated_bundles": "content.json* bundle the vendored-cluster skill bodies above.",
     "self": "the linter + its denylist + the source-confidentiality rule necessarily contain the deny tokens as data.",
     "validate_safe_paths": "telegraph-derived (MIT) ported code; upstream attribution is license-required.",
-    "archived_roadmaps_newly_tracked": "Archived roadmaps (and their assets) that predate the source-confidentiality sweep became tracked via the 2026-07 agents-dir gitignore hygiene change. They are frozen historical records; the claudekit mentions are ADR-061 license-attribution work and the remaining names are historical planning references. New roadmaps stay subject to the gate."
+    "archived_roadmaps_newly_tracked": "Archived roadmaps (and their assets) that predate the source-confidentiality sweep became tracked via the 2026-07 agents-dir gitignore hygiene change. They are frozen historical records; the claudekit mentions are ADR-061 license-attribution work and the remaining names are historical planning references. New roadmaps stay subject to the gate. road-to-ecosystem-harvest-index.md is the sharpest case: the flagged line is its own acceptance criterion, 'No harvest-family artifact names a real external source' — it quotes the names in order to assert their absence, so the gate fires on the sentence that records the cleanup. road-to-opt-retrieval-and-memory.md was REMOVED from this list on 2026-07-28 (road-to-native-code-intelligence Phase 6): its two clear-text mentions named a gitignored borrow-catalogue inbox file, which carries no historical value that a neutral descriptor loses — so the mentions were rewritten and the exception retired rather than kept. Retiring an exception is preferred over holding one whenever the named token is not license-required attribution and not load-bearing for the record."
   },
   "_excluded_tokens": {
     "agent-os": "collides with our own coined 'Agent-OS primitive' term (universal-skills) — too FP-prone to auto-deny; scrub external 'agent-os' mentions by review.",

package/src/scripts/first_run_gate_hook.ts

@@ -38,6 +38,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
+import { readHookStdin } from "./hooks/hook_stdin.js";
+
 const PLUGIN_ID = "agent-config@event4u-agent-config";
 const ACTION_NEEDED_FILE = ".augment/.first-run-action-needed.md";
 
@@ -222,11 +224,7 @@ export function parse_args(argv: string[]): ParsedArgs {
 }
 
 function _readStdin(): void {
-  try {
-    fs.readFileSync(0, "utf-8");
-  } catch {
-    /* ignore */
-  }
+  readHookStdin();
 }
 
 export function main(argv?: string[]): number {
@@ -238,7 +236,13 @@ export function main(argv?: string[]): number {
   return run(consumer_root);
 }
 
+// Bundle-safety: never auto-run when inlined into an esbuild bundle, where
+// every module shares the bundle's `import.meta.url` (see cmd_migrate.ts).
+declare const __AGENT_CONFIG_BUNDLE__: boolean | undefined;
 function _isCliEntry(): boolean {
+    if (typeof __AGENT_CONFIG_BUNDLE__ !== 'undefined' && __AGENT_CONFIG_BUNDLE__) {
+        return false;
+    }
     if (process.argv[1] === undefined) {
         return false;
     }

package/src/scripts/generate_index.ts

@@ -25,6 +25,7 @@ import {
     strip_source_prefix,
 } from './_lib/agent_src.js';
 import { computeStatus as domainSoundnessStatus } from './domain_soundness_status.js';
+import { skip_compile_disabled_rule } from './condense.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 
@@ -243,6 +244,12 @@ export function _collect_skills(): Entry[] {
     return _sortedKeys(seen).map((k) => seen.get(k) as Entry);
 }
 
+// docs/catalog.md is a SHIPPED file, so a relative link from it must resolve inside
+// package.json#files. docs/proof.md is not shipped and cannot be: it is 58KB of
+// generated output linking eight paths under internal/bench/, tests/ and src/scripts/
+// that are themselves unshipped, so shipping it would hand consumers a page of dead
+// links. The published site URL is the honest target for a consumer-facing pointer.
+
 export function _collect_rules(): Entry[] {
     const seen = new Map<string, Entry>();
     for (const srcRoot of artefact_roots()) {
@@ -255,6 +262,14 @@ export function _collect_rules(): Entry[] {
             if (seen.has(stem)) {
                 continue;
             }
+            // A compile-disabled rule has no dist/agent-src/ counterpart, and the
+            // table links the SHIPPED path — so listing it emits a dead link. The
+            // toggle is a separate axis from the source file's existence; this is its
+            // fifth consumer after the router compiler, the dist writer, check_sync,
+            // and the per-tool symlink generator. Same predicate in all five.
+            if (skip_compile_disabled_rule(`rules/${stem}.md`)) {
+                continue;
+            }
             const fm = _parse_frontmatter(fs.readFileSync(ruleMd, 'utf-8'));
             seen.set(stem, {
                 kind: 'rule',
@@ -420,7 +435,8 @@ export function _render_catalog(
         '> not yet. Coverage is reported per tier (`./scripts-run',
         '> src/scripts/skill_eval_coverage`) and CI-ratcheted so it can only rise.',
         '> Listing here never implies a skill is behaviourally tested — the',
-        '> current coverage and its gap are published on [the proof page](proof.md).',
+        '> current coverage and its gap are published on [the proof page]' +
+            '(https://event4u-app.github.io/agent-config/proof/).',
         '',
         '> **Non-coding domain correctness is scoped, not proven.** The',
         '> `finance` / `founder` / `ops` / `content` skills are forged on TS/PHP',
@@ -429,7 +445,8 @@ export function _render_catalog(
         '> cited formulas, or rubric targets matching a named external practice);',
         '> the rest are labeled `unvalidated` until they pass one',
         '> (`./scripts-run src/scripts/domain_soundness_status`). A disclaimer',
-        '> floor bounds liability, not correctness — see [the proof page](proof.md).',
+        '> floor bounds liability, not correctness — see [the proof page]' +
+            '(https://event4u-app.github.io/agent-config/proof/).',
         '',
         _render_table(skills, ['kind', 'name', 'source', 'description'], '../', _to_shipped_path),
         '',

package/src/scripts/hermetic-install.sh

@@ -15,7 +15,7 @@
 #  (a) stages a tarball from `npm pack` or operator-supplied .tgz
 #  (b) verifies sha256sum against a separate-channel manifest +
 #      operator GPG key
-#  (c) invokes `scripts/install.py --offline --package-dir=<staging>`
+#  (c) invokes `scripts/install.ts --offline --package-dir=<staging>`
 #  (d) writes additive lockfile fields under schema_version: 1
 #      (installation_mode, package_checksum, signature_verified)
 #
@@ -24,7 +24,7 @@
 #   1   — argument error
 #   2   — checksum mismatch
 #   3   — GPG verification failed
-#   4   — install.py invocation failed
+#   4   — install.ts invocation failed
 #   5   — required dependency missing
 
 set -euo pipefail
@@ -53,7 +53,7 @@ Optional:
                     (default: $(mktemp -d)).
   --package-version Override the semver written to installed.lock
                     (default: parse package.json after extraction).
-  --dry-run         Verify everything but skip install.py invocation.
+  --dry-run         Verify everything but skip install.ts invocation.
 
 Exit codes: 0 ok · 1 args · 2 checksum · 3 gpg · 4 install · 5 dep
 USAGE

package/src/scripts/hook_manifest.yaml

@@ -76,6 +76,21 @@ concerns:
     script: src/scripts/hooks/block_no_verify.ts
     args: []
     fail_closed: true
+  # road-to-ai-employee-borrowings Phase 1 — kernel immutability Layer 1.
+  # PreToolUse guard: DENIES Write/Edit/NotebookEdit (and cross-platform
+  # equivalents) whose target path is a kernel rule file — the source tree
+  # (src/rules/<kernel>.md) or any projection (dist/agent-src/rules/,
+  # .claude/**/rules/, .augment/rules/, …). ADR-127 permits more than one
+  # blocking hook; this is the second (after block-no-verify). fail_closed:
+  # a parse/detection failure never crashes into a false block — the
+  # guarantee applies to a DETECTED kernel-rule write, which this hook
+  # always catches deterministically (no I/O beyond stdin). No
+  # agent-accessible override — the only legitimate bypass is the
+  # human-owned exception registry named in the deny message.
+  block-kernel-rule-writes:
+    script: src/scripts/hooks/block_kernel_rule_writes.ts
+    args: []
+    fail_closed: true
   # token-saving Phase 3 — PreToolUse RTK-wrap nudge. DETERMINISTIC: keys off a
   # live `which rtk` probe (not the self-reported flag). When rtk is installed
   # and the agent is about to run a single verbose CLI command that is NOT
@@ -109,6 +124,19 @@ concerns:
     script: src/scripts/hooks/code_graph_nudge_hook.ts
     args: []
     fail_closed: false
+  # road-to-reachable-code-memory Phase 4 — session_end learning-sidecar
+  # aggregation. Joins the EXISTING session_end concern set (no new platform
+  # wiring). Aggregates agents/memory/intake/*.jsonl through the learning
+  # sidecar into the gitignored .agent-learning.json + LESSONS.md; emits the
+  # one-line memory-visibility marker when lessons exist. Default-OFF
+  # (memory.learn_on_session_end — council 2026-07-27: ships off; flip is
+  # proposed only after the 30-day dogfood shows non-trivial signal AND
+  # session-end p95 < 2 s). Budget-capped (2 s), fail-open. Promotion stays
+  # human via /memory:propose. fail_closed: false.
+  memory-learn:
+    script: src/scripts/memory_learn_hook.ts
+    args: []
+    fail_closed: false
   # Phase 2 of road-to-hooks-actually-fire-in-consumers — session_start
   # gate that surfaces the marketplace-install-but-unscaffolded shape.
   # Writes .augment/.first-run-action-needed.md + one stderr line so
@@ -166,21 +194,32 @@ concerns:
     script: src/scripts/pr_url_reminder_hook.ts
     args: []
     fail_closed: false
+  # session_start canary injection — deterministic carrier for the
+  # session-canary rule (greet-by-name at task start + reply-close markers
+  # as a user-observable context-degradation signal). Gated on
+  # `personal.canary_name` in .agent-settings.yml (empty = clean no-op),
+  # so unconfigured consumers pay nothing. Emits a `context` block the
+  # dispatcher forwards on session_start (hot-context mechanism).
+  # Never blocks. fail_closed: false.
+  session-canary:
+    script: src/scripts/session_canary_hook.ts
+    args: []
+    fail_closed: false
 
 platforms:
   augment:
-    session_start:    [chat-history, hot-context, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
-    session_end:      [chat-history]
+    session_start:    [chat-history, hot-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
+    session_end:      [chat-history, memory-learn]
     stop:             [chat-history, hot-context, verify-before-complete]
-    pre_tool_use:     [block-no-verify, rtk-wrap, design-slop, code-graph-nudge]
+    pre_tool_use:     [block-no-verify, block-kernel-rule-writes, rtk-wrap, design-slop, code-graph-nudge]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
 
   claude:
-    session_start:    [chat-history, hot-context, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
-    session_end:      [chat-history]
+    session_start:    [chat-history, hot-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
+    session_end:      [chat-history, memory-learn]
     stop:             [chat-history, hot-context, verify-before-complete, team-review-gate]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff]
-    pre_tool_use:     [block-no-verify, rtk-wrap, design-slop, code-graph-nudge]
+    pre_tool_use:     [block-no-verify, block-kernel-rule-writes, rtk-wrap, design-slop, code-graph-nudge]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
 
   # Cowork — the Claude desktop app's local-agent-mode runtime, built
@@ -198,11 +237,11 @@ platforms:
   # Decision matrix + upstream blockers tracked in
   # agents/settings/contexts/chat-history-platform-hooks.md § Cowork.
   cowork:
-    session_start:    [chat-history, hot-context, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
-    session_end:      [chat-history]
+    session_start:    [chat-history, hot-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
+    session_end:      [chat-history, memory-learn]
     stop:             [chat-history, hot-context, verify-before-complete]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff]
-    pre_tool_use:     [block-no-verify, rtk-wrap, design-slop, code-graph-nudge]
+    pre_tool_use:     [block-no-verify, block-kernel-rule-writes, rtk-wrap, design-slop, code-graph-nudge]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
 
   # Phase 7.5 — Cursor. `.cursor/hooks.json` (project) is read by the
@@ -213,8 +252,8 @@ platforms:
   # IDE-only — CLI-only users fall back to /checkpoint per
   # agents/settings/contexts/chat-history-platform-hooks.md.
   cursor:
-    session_start:      [chat-history, hot-context, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
-    session_end:        [chat-history]
+    session_start:      [chat-history, hot-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
+    session_end:        [chat-history, memory-learn]
     stop:               [chat-history, hot-context, verify-before-complete]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff]
     post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
@@ -228,8 +267,8 @@ platforms:
   # both map to session_start. TaskCancel maps to stop because the
   # session is interrupted with partial state (mirrors Augment Stop).
   cline:
-    session_start:      [chat-history, hot-context, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
-    session_end:        [chat-history]
+    session_start:      [chat-history, hot-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
+    session_end:        [chat-history, memory-learn]
     stop:               [chat-history, hot-context, verify-before-complete]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff]
     post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
@@ -247,7 +286,7 @@ platforms:
   # surface to record verification commands; documented limitation).
   # minimal-safe-diff is omitted entirely on Windsurf for the same reason.
   windsurf:
-    session_start:      [chat-history, hot-context, first-run-gate, onboarding-gate, verify-before-complete, profile-staleness, wrapper-freshness, surface-probe]
+    session_start:      [chat-history, hot-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, profile-staleness, wrapper-freshness, surface-probe]
     stop:               [chat-history, hot-context, verify-before-complete]
     user_prompt_submit: [chat-history, verify-before-complete]
 
@@ -262,8 +301,8 @@ platforms:
   # turn-check semantics. AfterAgent fires when the agent loop ends
   # — this is our `stop` slot.
   gemini:
-    session_start:      [chat-history, hot-context, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
-    session_end:        [chat-history]
+    session_start:      [chat-history, hot-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
+    session_end:        [chat-history, memory-learn]
     stop:               [chat-history, hot-context, verify-before-complete]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff]
     post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]