@event4u/agent-config 9.8.0 → 9.9.0

package/dist/agent-src/contexts/authority/kernel-rule-edits.md

@@ -2,7 +2,7 @@
 
 Loaded by [`scope-control`](../../rules/scope-control.md). Codifies the
 soak-time guarantee for edits to always-loaded (kernel) rules under
-`.agent-src.uncondensed/rules/`.
+`src/rules/`.
 
 **Size budget:** ≤ 1,500 chars.
 

package/dist/agent-src/contexts/contracts/emergency-triage-block.md

@@ -26,7 +26,7 @@ Use this variant in `AGENTS.md` at the package root.
 
 ## Consumer-template variant
 
-Use this variant in `.agent-src.uncondensed/templates/AGENTS.md`. The
+Use this variant in `src/agent-src/templates/AGENTS.md`. The
 consumer's `AGENTS.md` lands at the consumer-project root after install.
 
 ```
@@ -45,7 +45,7 @@ The package-root and the consumer template answer the same five
 questions but in different repos:
 
 - The package-root variant points at this repo's authoring layer
-  (`.agent-src.uncondensed/`) and the package's CI entry point.
+  (`src/`) and the package's CI entry point.
 - The consumer variant tells the agent it is in a **consumer** project
   where `.augment/` is an installed artifact and editing it is wrong.
 

package/dist/agent-src/contexts/execution/auto-dispatch-classification.md

@@ -85,6 +85,49 @@ Every inferred decision records `tier_source: "inferred"` in orchestration
 telemetry (static pins record `"static"`; session-tier runs `"inherit"`) so
 the evidence gate scores inferred routing separately from static pinning.
 
+## Lookup-class rung (L0 — road-to-lean-agent-init, BELOW the tiers)
+
+Before any spawn decision, a lookup-shaped task routes to a **deterministic
+primitive** — no subagent, no tier. Live evidence (2026-07-28): four
+`general-purpose` workers burned ~1.21M tokens on four lookup tasks a
+primitive answers for <1k each.
+
+```
+LOOKUP-SHAPED TASK → DETERMINISTIC PRIMITIVE. NO SUBAGENT SPAWN.
+INDEX-MISS OR GENUINE AMBIGUITY → REGULAR ESCALATION TO A SUBAGENT —
+NEVER A SILENTLY DEGRADED ANSWER. NO LLM CLASSIFIER FALLBACK (CUT C3).
+```
+
+| Task pattern | Lookup class | Primitive |
+|---|---|---|
+| "where is X defined" / "confirm X's definition location" | `definition` | capped `rg` (definition-shaped patterns, `--max-count`); `code_graph query` only as opportunistic accelerant when an index is present + fresh + `hooks.code_graph.enabled: true` |
+| "who calls / imports X" / "confirm call sites" | `references` | capped `rg` (reference-shaped patterns); same optional `code_graph affected` accelerant clause |
+| "does string Y exist" / "probe candidate strings" | `string-existence` | FTS one-shot (`memory_lookup` for the knowledge corpus) or capped `rg -n --max-count` for the codebase |
+| "run report Z" / "run check_*" | `report-run` | direct script run, wrapped per the **measured** rtk allowlist (`internal/bench/rtk-savings/RESULTS.md` — wrap only the ~55%-savings class) |
+
+**Why rg-first for definition/references** (council debate 2026-07-28,
+claude-sonnet-4-5 + gpt-4o, 2 rounds): the pre-registered benchmark behind the
+`code-graph-retrieval-null` claim (`docs/CLAIMS.md`) measured native-graph
+recall 0.365 vs grep 0.797 on graph-shaped questions, root cause an **indexing
+gap** (TS arrow-function exports produce no symbol nodes) that hits structured
+lookups exactly as it hits NL retrieval — and the recorded consequence bound
+keeps `code_graph.enabled` false permanently. The accelerant clause is the
+escape hatch that bound names ("unless external evidence appears"); today
+inert.
+
+**Escalation, not degradation:** a primitive returning nothing (index miss,
+ambiguous pattern, absent report script) — **or an unusable result** (empty,
+ambiguous between candidates, or visibly off-target because the lookup
+pattern matched a task that was not actually a lookup, e.g. a dynamically
+constructed symbol name) — escalates to the regular classification path —
+answer-quality bar never drops. "Primitive ran but result unusable"
+escalates exactly like "class unknown". `unknown` resolves to the regular
+path (`inherit` semantics), never down-guessed.
+
+Correctness floor: golden comparison in `internal/bench/lean-init/`
+(primitive answer ≡ agent answer on ≥10 lookup tasks, incl. the four observed
+shapes); any mismatch is a routing bug, not a rounding error.
+
 ## v2+ (deferred, gated on Phase 6 evidence)
 
 LLM-based classification — only if the deterministic rules prove too coarse
@@ -95,8 +138,11 @@ budgeted (consume part of the N=3 autonomous budget) and opt-in. Not in v1.
 
 The deterministic rules are encoded in
 [`src/scripts/_lib/auto_dispatch.ts`](../../../../src/scripts/_lib/auto_dispatch.ts)
-(`classifyTask`), covered by
-[`tests/scripts/_lib_auto_dispatch.test.ts`](../../../../tests/scripts/_lib_auto_dispatch.test.ts).
+(`classifyTask`, `classifyLookup` for the lookup-class rung), covered by
+[`tests/scripts/_lib_auto_dispatch.test.ts`](../../../../tests/scripts/_lib_auto_dispatch.test.ts)
+and the lookup corpus in
+[`src/scripts/_lib/auto_dispatch.corpus.test.ts`](../../../../src/scripts/_lib/auto_dispatch.corpus.test.ts)
+(`LOOKUP_CORPUS` — the four live-observed shapes + negative controls).
 
 ## Related
 

package/dist/agent-src/contexts/execution/orchestration-telemetry.md

@@ -56,6 +56,16 @@ v1 forward-compat rule on unknown fields).
 | `session_tier` | string \| null | **Cost-% extension.** The orchestrator's OWN tier — the baseline the downshift cost-% measures `tier_chosen` against (a `high`→`lite` downshift is a rate win the token count can't see). `null` = not recorded. |
 | `first_pass_success` | bool \| null | **QUALITY extension (council verdict: quality × cost paired).** `true` = the subagent return was adopted without parent rework; `false` = the parent had to rework the return before adopting. Precise rework definition: § Operationalization below. `null` = pre-extension line / not measured. Boolean only, no bodies. |
 | `escalated` | bool \| null | **QUALITY extension (council verdict: quality × cost paired).** `true` = the slice was retried on a higher tier after a verification failure; `false` = no escalation. Semantics: § Operationalization below. `null` = pre-extension line / not measured. Boolean only, no bodies. |
+| `init_tokens` | int \| null | **Lean-init extension (road-to-lean-agent-init Phase 3).** Spawn-payload tokens at worker init — the payload-truth measurement feeding the Phase-5 baseline gate (p95 < ~1,500 tokens/worker drops the L2/L3 bets). `null` = not measured. Counts only. |
+| `payload_hash` | string \| null | **Lean-init extension.** 8–64-char hex digest of the spawn payload — prefix-stability / cache measurement. A hash can never smuggle content (privacy by construction). `null` = not measured. |
+| `lookup_class` | enum \| null | **Lean-init extension.** Lookup class the L0 rung matched: `definition` · `references` · `string-existence` · `report-run`. `null` = not a lookup-shaped dispatch. |
+| `route_taken` | enum \| null | **Lean-init extension.** `primitive` (deterministic primitive answered — no spawn) · `subagent` (escalated). With `lookup_class`, measures the tool-not-agent rung's hit rate. A `primitive` line is the ONE recordable zero-spawn event (`spawn_count: 0`) — the routing decision itself is the datum the cost claim reads. |
+| `budget_hit` | bool \| null | **Lean-init extension.** Worker hit its `max_tokens_per_worker` stop-loss (L0b) and returned the structured partial result. Feeds budget-seed refinement. `null` = not measured. |
+| `correctness_match` | bool \| null | **Lean-init extension.** Golden/correctness comparison verdict for a primitive route (primitive answer ≡ agent answer). Populated only when a comparison arm actually ran (bench/golden mode); on real zero-spawn primitive routes there is no agent answer to compare against, so `null` is the NORMAL field value — never read `null` as "unchecked = suspicious". |
+| `cache_hit` | bool \| null | **Lean-init extension (Phase 4 prefix stability).** Provider-reported prompt-cache hit on the spawn payload. Measurement only — no savings claim without provider-response evidence. `null` = not measured. |
+| `origin` | string \| null | **Lean-init extension (council Q5 segregation).** Id-shaped sample tag (`lean-init-2026`) keeping lean-init efficiency lines cleanly separable from the `road-to-orchestration-scope-decision` sample. `null` = untagged line. Never free-form. |
+| `rules_carried` | int \| null | **Lean-init extension (L6 demand signal).** Rules in the worker's scoped projection — the carried set. With `rules_used`, yields the per-worker rule-usage quota the parked `later/road-to-deferred-rule-retriever` resume condition asks for ("are worker rules actually carried unused?"). `null` = not measured. Counts only. |
+| `rules_used` | int \| null | **Lean-init extension (L6 demand signal).** Rules the worker actually applied/cited. Validation: never exceeds `rules_carried`. `null` = not measured. Counts only. |
 
 These routing + cost fields are additive and optional — a line without them is
 still a valid orchestration line; readers ignore unknown fields per the v1

package/dist/agent-src/contexts/execution/subagent-modes-detail.md

@@ -1,11 +1,112 @@
-# Subagent Modes — worktree + live-app-judge + adversarial-council detail
-
-Extended detail for the heaviest [`subagent-orchestration`](../../skills/subagent-orchestration/SKILL.md)
-modes — `do-in-worktrees` (mode 7), `do-with-live-app-judge` (mode 8), and
-`adversarial-verification-council` (mode 9). Split out of the skill body to keep
-it under the size budget; the mode list, selection rules, and the six common
-modes stay inline in the skill. Pull this when you actually dispatch one of these
-modes.
+# Subagent Modes — per-mode detail (decision rows, contracts, heavy modes)
+
+Extended detail for the [`subagent-orchestration`](../../skills/subagent-orchestration/SKILL.md)
+modes. Split out of the skill body to keep it under the size budget; the mode
+list, form gate, selection rules, and procedure stay inline in the skill. Pull
+this when you dispatch a mode and need its decision row, execution contract, or
+the heavy-mode detail (modes 7–9).
+
+## Modes 1–6 — decision rows and execution contracts
+
+### Mode 1 — do-and-judge
+
+| When to use | When not | Model pairing |
+|---|---|---|
+| Single-change task with non-trivial risk | Tiny fix, or spike/exploration | implementer = session; judge = one tier up |
+
+### Mode 2 — do-and-judge-two-stage
+
+Implementer produces a diff; **two judges run sequentially** — first a
+spec-compliance reviewer (does the diff satisfy the stated spec /
+acceptance criteria?), then a code-quality reviewer (is the diff well-
+written for the codebase it lands in?). The orchestrator only proceeds
+to stage two if stage one returns `DONE` or `DONE_WITH_CONCERNS`. A
+stage-one `BLOCKED` shortcuts the loop — there is no point quality-
+reviewing a diff that does not satisfy the spec.
+
+| When to use | When not | Model pairing |
+|---|---|---|
+| Spec is contested or AC are detailed; diff size makes one judge prone to missing one axis (correctness vs craft) | Spec is one sentence, or the diff is one line (collapse to mode 1) | implementer = session; spec-judge = one tier up; quality-judge = same tier as spec-judge, fresh context |
+
+**Why two stages, not one judge with both rubrics:** combining the
+rubrics in one prompt reliably regresses one of them — the judge "spends
+attention" on whichever rubric appears last. Splitting the prompts
+forces each judge to commit fully to its rubric.
+
+**Stage-routing rule:**
+- Stage-1 returns `DONE` → run stage-2.
+- Stage-1 returns `DONE_WITH_CONCERNS` → run stage-2; concerns carry
+  forward to the final envelope.
+- Stage-1 returns `NEEDS_CONTEXT` → pause; stage-2 does not run.
+- Stage-1 returns `BLOCKED` → final verdict is `BLOCKED`; stage-2
+  does not run (saves cost).
+
+### Mode 3 — do-in-steps
+
+| When to use | When not | Model pairing |
+|---|---|---|
+| Multi-step plan with ordered dependencies | Single-step change, or when steps are independent (use `do-in-parallel`) | implementer = session; judge = one tier up |
+
+### Mode 4 — do-in-parallel
+
+| When to use | When not | Model pairing |
+|---|---|---|
+| Independent slices (different files, non-overlapping) | Any slice touches shared state | implementer = session; judge = one tier up, run once |
+
+### Mode 5 — do-competitively
+
+| When to use | When not | Model pairing |
+|---|---|---|
+| Broad solution space (algorithm choice, API shape) | Well-defined problem with one good answer | implementers = same tier (≥2 instances); judge = one tier up |
+
+### Mode 6 — judge-with-debate
+
+| When to use | When not | Model pairing |
+|---|---|---|
+| Security, data integrity, public API change | Routine internal refactor | judges = same tier (2x); meta-judge = one tier up |
+
+## Severity-conditioned team composition — conditions pattern
+
+Guidance, not a new object class (persona-catalog disposition; AI council
+2026-07-27, claude-sonnet-4-5 + gpt-4o: capture as guidance on this
+existing surface — no roster schema, no linter, no fourth scoping
+ontology). Incident-style severity tiers refine composition and
+activation **within** the form the static gate already picked — severity
+never overrides the form gate, the Iron Law, or any safety floor.
+
+| Severity | Composition + activation | Existing mode(s) |
+|---|---|---|
+| Critical — prod impact, security, data integrity | Full parallel team; debate-grade review on the aggregate | `do-in-parallel` + `judge-with-debate` (Mode 9 where opted in) |
+| High — contested spec, cross-layer risk | Implementer + two sequential judges | `do-and-judge-two-stage` |
+| Medium — routine multi-step | Implementer + judge between steps | `do-in-steps` / `do-and-judge` |
+| Low — small, reversible | Solo with async review | in-session (`none`); optional single async judge |
+
+At equal severity the cheapest-mode preference (skill § 3. Pick the mode)
+still applies; escalate one tier only on a named risk signal, never on
+vibes.
+
+## Status taxonomy — rationale and routing semantics
+
+Every implementer or judge return conforms to
+[`schemas/subagent-status.json`](../../../skills/subagent-orchestration/schemas/subagent-status.json).
+Four statuses, no free-form alternatives:
+
+| Status | Meaning | Required keys (beyond `status`, `summary`) |
+|---|---|---|
+| `DONE` | Work shipped, all gates green. | `evidence[]` |
+| `DONE_WITH_CONCERNS` | Work shipped but caller must act on concerns. | `evidence[]`, `concerns[]` |
+| `NEEDS_CONTEXT` | Paused; caller can unblock by answering. | `blocking_question` |
+| `BLOCKED` | No path forward exists. | `blocking_reason` |
+
+**Why a fixed taxonomy:** orchestrators (`/do-and-judge`, `/do-in-steps`)
+route on status. Free-form "kind of done" returns force the orchestrator
+to interpret prose, which silently regresses the two-revision ceiling and
+the judge-rejected-do-not-apply rule. The schema makes routing mechanical.
+
+**Distinguishing `NEEDS_CONTEXT` from `BLOCKED`:** `NEEDS_CONTEXT` means
+*"you, the caller, can fix this by telling me X"*. `BLOCKED` means
+*"no input from you unblocks this — escalate or rescope"*. If a subagent
+is unsure, it picks `BLOCKED` and the caller can downgrade.
 
 ## Mode 7 — do-in-worktrees
 

package/dist/agent-src/contexts/execution/subagent-response-contract.md

@@ -21,6 +21,26 @@ orchestrator synthesises and re-verifies.
   never inline content — same minimal-slice / privacy floor as the spawn contract.
 - `mutating` marks a finding whose action changes files/state (feeds the verify link).
 
+## Budget-hit partial result
+
+Worker's `max_tokens_per_worker` stop-loss fires
+([spawn contract § Per-worker token stop-loss](subagent-spawn-contract.md#per-worker-token-stop-loss-l0b--hard-budget-structured-escalation))
+→ return is `BLOCKED` envelope whose body is this shape instead:
+
+```json
+{
+  "budget_hit": true,
+  "found": ["file:line | id | path"],
+  "remaining": "<what stays unexplored, one sentence>",
+  "suggested_next_rung": "primitive | higher-tier-subagent | in-session"
+}
+```
+
+`budget_hit: true` is the escalation flag; `found` follows same
+refs-not-bodies floor as `evidence_refs`. Validator:
+`worker_budget.validateWorkerPartialResult` — orchestrator never adopts
+invalid partial return.
+
 ## Orchestrator synthesis duties
 
 ```

package/dist/agent-src/contexts/execution/subagent-spawn-contract.md

@@ -13,7 +13,8 @@ task without re-inventing any taxonomy.
   "role_mode": "developer|reviewer|tester|po|incident|planner|null",
   "profile": "<active profile id or null>",
   "personas": ["<persona id>", "..."],
-  "knowledge_refs": ["<id-or-path>", "..."]
+  "knowledge_refs": ["<id-or-path>", "..."],
+  "max_tokens_per_worker": 15000
 }
 ```
 
@@ -41,6 +42,28 @@ private-data leg stays narrow: the composer rejects inline bodies (multi-line /
 oversized entries), accepts only ref-like tokens, and caps the count. Anything
 dropped is recorded in `warnings` and surfaced — never silently widened.
 
+## Per-worker token stop-loss (L0b) — hard budget, structured escalation
+
+```
+EVERY DISPATCHED WORKER CARRIES A max_tokens_per_worker BUDGET FOR ITS TIER.
+ON HIT: RETURN A STRUCTURED PARTIAL RESULT + ESCALATION FLAG — STOP EXPLORING.
+A WORKER OVERRUNNING ITS BUDGET 20× IS A DISPATCH ERROR ON THE WRONG RUNG,
+NOT DILIGENCE.
+```
+
+Budgets keyed by the worker's resolved tier
+(`worker_budget.budgetForTier`; start values `lite: 15k` — the lookup-class
+seed — `medium: 60k`, `high: 150k`, refined from `budget_hit` telemetry, never
+final). On hit the worker returns a `BLOCKED` envelope whose body is the
+partial-result shape from the
+[response contract](subagent-response-contract.md#budget-hit-partial-result):
+what was found (refs), what remains, suggested next rung. The stop-loss
+**composes** with the N=3 validation budget
+([`autonomous-execution`](../../rules/autonomous-execution.md)) and the
+ADR-109 response contract — replaces nothing. Live evidence (2026-07-28):
+four lookup-class workers burned 280–327k tokens each on tasks a
+deterministic primitive answers for <1k.
+
 ## Bundle resolver — bind to the existing surfaces
 
 The brief is **resolved**, not hand-built. `resolveBundle(slice)` maps a task
@@ -64,9 +87,36 @@ only, never bodies.
 
 [`src/scripts/_lib/subagent_spawn.ts`](../../../../src/scripts/_lib/subagent_spawn.ts)
 (`composeSpawnBrief`) + [`src/scripts/_lib/subagent_bundle.ts`](../../../../src/scripts/_lib/subagent_bundle.ts)
-(`resolveBundle`, `filterKnowledgeByPolicy`, `bundleAuditLine`), covered by
+(`resolveBundle`, `filterKnowledgeByPolicy`, `bundleAuditLine`) +
+[`src/scripts/_lib/worker_budget.ts`](../../../../src/scripts/_lib/worker_budget.ts)
+(`budgetForTier`, `evaluateWorkerBudget`, `validateWorkerPartialResult`),
+covered by
 [`tests/scripts/_lib_subagent_spawn.test.ts`](../../../../tests/scripts/_lib_subagent_spawn.test.ts)
-+ [`tests/scripts/_lib_subagent_bundle.test.ts`](../../../../tests/scripts/_lib_subagent_bundle.test.ts).
++ [`tests/scripts/_lib_subagent_bundle.test.ts`](../../../../tests/scripts/_lib_subagent_bundle.test.ts)
++ [`tests/scripts/_lib_worker_budget.test.ts`](../../../../tests/scripts/_lib_worker_budget.test.ts)
+(the budget-hit partial-result fixture).
+
+## Worker rtk allowlist — wrap only the measured class
+
+Worker tool loops wrap a command with rtk **only** when that command class
+measured ≥ ~50% output saving in `internal/bench/rtk-savings/RESULTS.md`
+(`git status`, full-format `git log -N`, `ls -la`); the ~0%-class
+(`--oneline`, `--stat` views, `npm ls`) stays unwrapped — wrap overhead
+without return. Deterministic list: `src/scripts/_lib/rtk_allowlist.ts`
+(`shouldWrapWithRtk`); congruence with RESULTS.md is test-enforced
+(`tests/scripts/_lib_rtk_allowlist.test.ts`) — numbers live in the bench
+file, referenced, never duplicated.
+
+## Prefix stability — deterministic payload ordering
+
+Spawn payloads serialize **static prefix first** (role contract, profile,
+personas, budget — byte-identical across dispatches of the same
+configuration), **variable task part last**; no timestamps, no random IDs
+(`serializeSpawnPayload` / `spawnPayloadHash`). Provider prompt-caching keys
+on the stable prefix; `payload_hash` + `cache_hit` audit fields
+([`orchestration-telemetry`](orchestration-telemetry.md)) measure whether it
+actually hits. Measurement only — no savings claim without provider-response
+evidence.
 
 ## Worker-prompt rules — verbatim at spawn
 

package/dist/agent-src/rules/code-provenance.md

@@ -0,0 +1,112 @@
+---
+type: "auto"
+tier: "2a"
+alwaysApply: false
+description: "About to port/adapt/reuse external code (algorithm, structure, >~10 lines) — read, close the source, re-derive; conscious borrows need a ledger entry + license check first"
+triggers:
+  - intent: "porting or adapting code from an external source"
+  - intent: "implementing an algorithm or structure seen in another project"
+  - intent: "reusing a snippet from online / another repo / a training-data recall"
+  - keyword: "port this"
+  - keyword: "adapt this"
+  - keyword: "based on this repo"
+  - keyword: "similar implementation"
+  - keyword: "found this on GitHub"
+  - keyword: "borrow"
+  - keyword: "vendored"
+  - keyword: "reference implementation"
+routes_to:
+  - "skill:license-compliance-borrow-check"
+  - "skill:license-compliance-credits"
+  - "skill:license-compliance-audit"
+workspaces: [engineering]
+packs: [engineering-base]
+roles: [developer, reviewer, tester, po, incident, planner]
+enforced_by:
+  - "none"
+---
+
+# Code Provenance
+
+AI coding agents can emit code near-verbatim from training data — output-side
+legal exposure is live (*Doe v. GitHub* proceeds on that factual premise). No
+rule previously told a worker what to do on a **conscious** borrow at the
+code layer — this rule closes that gap.
+
+## The Iron Law
+
+```
+NEVER ADOPT EXTERNAL CODE VERBATIM.
+BORROWING = READ → CLOSE THE SOURCE → RE-DERIVE AGAINST HOUSE STANDARDS → ADAPT.
+ANY CONSCIOUS BORROW (ALGORITHM, NON-TRIVIAL STRUCTURE, >~10 LINES OF LOGIC
+SHAPE) REQUIRES A PROVENANCE LEDGER ENTRY AND A LICENSE-COMPATIBILITY CHECK
+BEFORE THE CODE LANDS.
+UNKNOWN LICENSE ⇒ DO NOT BORROW. ESCALATE — NEVER GUESS PERMISSIVE.
+```
+
+## When it fires
+
+Porting, adapting, or reusing an algorithm, a non-trivial structure, or
+>~10 lines of logic shape from a source you read — a repo, an answer, a blog
+post, or a training-data recall with a nameable source. Before it lands:
+
+1. **Close the source** — copy-paste with edits is not re-derivation.
+2. **Re-derive** against this repo's own conventions — a renamed copy is
+   not a rewrite.
+3. **Check license compatibility** via
+   [`skill:license-compliance-borrow-check`](../skills/license-compliance-borrow-check/SKILL.md)
+   (wraps `detect_target_license.ts`'s derived policy) BEFORE the code
+   lands, never as a post-hoc justification.
+4. **Record the borrow** in `provenance/borrows.jsonl` with a real
+   `transformation_note` — rename-only phrasing is rejected by
+   `lint_provenance.ts`.
+
+An **unknown** source license is never permissive-by-default. Stop and
+escalate (numbered options, per
+[`ask-when-uncertain`](ask-when-uncertain.md)) instead of guessing.
+
+## Self-interrogation clause (AUXILIARY — never a control)
+
+Before finalizing any non-trivial function, ask internally: *"Did I derive
+this, or do I remember it?"* "Remember" + nameable source ⇒ treat as a
+borrow, run the steps above. "Remember" + no nameable source ⇒ flag
+`origin: uncertain` in the PR description (~0 tokens).
+
+Explicitly **non-load-bearing** (council 2026-07-28): an LLM cannot
+introspect recall vs. derivation, so the flag is an audit surface only — no
+gate, escalation, or clearance ever depends on it; the deterministic layer
+(where one exists at all, see below) scans regardless. It projects to every
+role in `roles:` above, `planner` included — the clause costs ~0 tokens, and
+excluding one role leaves a hole exactly where that role drafts
+implementation sketches.
+
+## No CI-facing detector — the ledger is the control
+
+Gate G0 measured both candidate similarity scanners against a frozen golden
+corpus; both missed their pre-registered thresholds — rename-only recall
+**0/8** (SCANOSS) / **4/8** (jscpd), union false positives 2/12 over the
+ceiling. Council resolved (2026-07-28, Option A): **no
+`lint_code_provenance.ts` in any form — not even advisory.** The scan
+capability exists only as the on-demand
+[`skill:license-compliance-audit`](../skills/license-compliance-audit/SKILL.md)
+a human invokes deliberately. CI enforces only `lint_provenance.ts` — it
+checks the ledger's own records, not similarity, and cannot catch an
+unrecorded borrow. The discipline above **is** the control; skipping it is
+not caught downstream by anything automatic. No script can enforce "close
+the source and re-derive" — a pre-write reasoning step only the model
+observes — so this rule ships `enforced_by: none`, same honesty stance as
+`security-sensitive-stop` and `untrusted-input-defense`.
+
+## When NOT to fire
+
+- A well-known, unpatentable algorithm shape (a hash map, a for-loop) with
+  no specific source in mind.
+- Reusing your **own** prior code within this repo.
+- Prose/docs/config-only edits.
+
+## See also
+
+- [`license-compliance-borrow-check`](../skills/license-compliance-borrow-check/SKILL.md), [`license-compliance-credits`](../skills/license-compliance-credits/SKILL.md), [`license-compliance-audit`](../skills/license-compliance-audit/SKILL.md) — the borrowing / notices / on-demand-scan skill family this rule routes to.
+- `provenance/README.md`, `src/scripts/lint_provenance.ts`, `src/scripts/detect_target_license.ts` — the ledger, its linter, and the S1.2 policy derivation.
+- [`secret-vcs-guard`](secret-vcs-guard.md) — sibling detect → ask → act discipline for a different leak class.
+- [`ask-when-uncertain`](ask-when-uncertain.md) — the escalation shape for `conditional`/`unknown` verdicts.

package/dist/agent-src/rules/external-code-graph-interop.md

@@ -64,10 +64,10 @@ AND the repo contains a detectable index:
 ## See also
 
 - [`code-intelligence`](../skills/code-intelligence/SKILL.md) — the executable
-  routing skill: `code_graph detect|query|affected|path` over the native engine
-  or a consumer-shipped index, grep as the stated fallback. On hook-capable
-  hosts the PreToolUse `code-graph` nudge surfaces this once per session; on
-  instruction-file hosts this rule is the surface.
+  routing skill: `agent-config code-graph detect|query|affected|path` over the
+  native engine or a consumer-shipped index, grep as the stated fallback. On
+  hook-capable hosts the PreToolUse `code-graph` nudge surfaces this once per
+  session; on instruction-file hosts this rule is the surface.
 - [`discovery_graph`](../scripts/discovery_graph.ts) — this suite's OWN artefact
   relation-graph (`affected`/`explain`); the external code-graph is the
   *source-code* analogue this rule defers to for code questions.

package/dist/agent-src/rules/history-discipline.md

@@ -0,0 +1,80 @@
+---
+type: "auto"
+tier: "2a"
+description: "Change history done right — audit coverage, cheapest-sufficient tier (default: row-level audit log; event sourcing only by waiver), audit hygiene + privacy interlocks."
+triggers:
+  - keyword: "audit"
+  - keyword: "audit log"
+  - keyword: "activity log"
+  - keyword: "history"
+  - keyword: "event sourcing"
+  - keyword: "changelog"
+  - phrase: "who changed"
+  - phrase: "wer hat was"
+  - phrase: "track changes"
+  - phrase: "change history"
+routes_to:
+  - "skill:history-design"
+workspaces: [engineering]
+packs: [history-discipline]
+trust:
+  level: professional
+---
+
+# History Discipline
+
+Pack floor for the `history-discipline` pack (default-off; auto-activates
+when the pack is installed). Agents get history wrong in both directions:
+missing entirely on data that needs it, or over-built as event sourcing
+where a row-level log suffices — and audit tables that themselves grow
+without bound.
+
+## The Iron Law
+
+```
+MUTATIONS ON AUDIT-SCOPED DATA EMIT WHO / WHAT / WHEN. ALWAYS.
+THE MECHANISM IS THE CHEAPEST SUFFICIENT TIER — DEFAULT: ROW-LEVEL
+AUDIT LOG. EVENT SOURCING ONLY WITH AN EXPLICIT ARCHITECTURE WAIVER.
+THE AUDIT TABLE OBEYS THE SAME GROWTH BUDGET AS EVERY OTHER TABLE.
+AUDIT RECORDS INHERIT THE PRIVACY OBLIGATIONS OF THE DATA THEY DESCRIBE.
+A LOSSY AUDIT TRAIL IS WORSE THAN NONE.
+```
+
+## Rule surface
+
+- **R-B1 audit-coverage** — mutations on declared audit-scoped models
+  emit who/what/when (actor id, diff or event, timestamp, correlation
+  id) (F8; checked by `lint_persistence` against the declared scope).
+- **R-B2 history-tier-selection** — the tier matrix is normative
+  (Tier 0 `updated_by` columns → Tier 1 row-level audit log → Tier 2
+  temporal tables → Tier 3 event sourcing). **Default: Tier 1.** Tier 3
+  requires an explicit architecture waiver — never upgrade unprompted.
+  The matrix and interlock walkthrough live in
+  [`history-design`](../skills/history-design/SKILL.md).
+- **R-B3 audit-table-hygiene** — audit storage indexed on
+  `(auditable_type, auditable_id, created_at)`; JSON diffs, not full-row
+  copies, where a diff suffices.
+- **R-B4 privacy-interlock** — a GDPR Art. 17 deletion/anonymization path
+  must exist for audit records before the mechanism ships.
+- **R-B5 reliable-history-interlock** — audit capture is same-transaction
+  (Tier-1 default: observer + cheap single insert) OR outbox/afterCommit
+  with a durable queue when offloaded — per
+  [`scale-discipline`](scale-discipline.md) R-A10/R-A11.
+
+## When NOT to fire
+
+- Git/VCS history questions (that is `git-workflow` territory).
+- Retention-duration policy questions ("how long may we keep X") — route
+  to `domain-safety-retention`; this rule owns the capture mechanism,
+  not the legal floor.
+
+## See also
+
+- [`history-design`](../skills/history-design/SKILL.md) — the tier
+  matrix walkthrough + decision artifact.
+- [`scale-discipline`](scale-discipline.md) — R-A7 growth budget and
+  R-A10/R-A11 reliability primitives this pack builds on.
+- [`domain-safety-retention`](domain-safety-retention.md) — jurisdiction
+  retention floors the R-A7 policy must respect.
+- [`domain-safety-pii`](domain-safety-pii.md) — PII discipline for what
+  audit diffs may contain.

package/dist/agent-src/rules/no-roadmap-references.md

@@ -73,6 +73,6 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 - [`roadmap-progress-sync`](roadmap-progress-sync.md) — sync dashboard
   on roadmap touch
 - [`source-of-truth`](source-of-truth.md) — edit
-  `.agent-src.uncondensed/`
+  `src/`
 - [`ai-council`](../skills/ai-council/SKILL.md) — output path
   convention and convergence-summary format

package/dist/agent-src/rules/php-coding.md

@@ -10,6 +10,7 @@ routes_to:
   - "guideline:php/php-coding-patterns"
 workspaces: [engineering]
 packs: [php]
+roles: [developer, reviewer]
 trust:
   level: professional
 install:

package/dist/agent-src/rules/reviewer-awareness.md

@@ -12,6 +12,7 @@ routes_to:
   - "skill:review-routing"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+roles: [reviewer]
 ---
 
 # Reviewer Awareness

package/dist/agent-src/rules/roadmap-ci-steps-policy.md

@@ -26,6 +26,7 @@ validator_ignore:
     reason: "Rule reads quality.local_auto_run from .agent-settings.yml; naming the file is the contract."
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+roles: [planner]
 ---
 
 # Roadmap CI-Steps Policy

package/dist/agent-src/rules/roadmap-progress-sync.md

@@ -11,6 +11,7 @@ routes_to:
   - "guideline:agent-infra/roadmap-progress-mechanics"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
+roles: [planner]
 enforced_by:
   - "hook:roadmap-progress"
 ---
@@ -75,6 +76,12 @@ Before sending any reply that landed roadmap work:
 
 1. Did this reply land a step (code/doc saved + verification passed)?
 2. Is its checkbox flipped to `[x]` / `[~]` / `[-]` in `agents/roadmaps/<file>.md`? If no → flip, then continue.
+2b. Roadmap created/updated from an `agents/tmp/` inbox file this reply? If
+   yes → `mv` it to `agents/tmp.old/` NOW, same reply (per
+   `agents-layout § User Inbox Workflow`); point the Source line at
+   `agents/tmp.old/<name>`. Consumed inbox file left in `agents/tmp/` = rule
+   violation, not tidiness. Move ONLY the explicitly named input file(s) —
+   never sweep the rest of the inbox.
 3. Is regen due now per `roadmap.dashboard_regen_cadence`?
    - `per_step` → yes, always.
    - `every_5_steps` → yes when this is the 5th, 10th, … closed step in the run, or the last step of the reply.