@event4u/agent-config 9.9.0 → 9.10.0

package/dist/agent-src/rules/domain-safety-pii.md

@@ -91,7 +91,7 @@ EVER REACHES THE LOG STREAM. ALLOWLISTED STRUCTURED FIELDS ONLY.
 Required patterns:
 
 1. **Allowlisted structured fields only.** Log `user_id`, `tenant_id`, `request_id`, `event_type` — never `user` or `request` blobs.
-2. **PII-exclusion-by-construction (preferred over redaction).** Make the log/event **type physically incapable** of holding free-form content — struct of allowlisted scalars, no `payload`/`body`/`extra: any`. A type that cannot carry a phone number has no scrubber to fail; redaction (next) is the fallback when a content field is unavoidable.
+2. **PII-exclusion-by-construction (preferred over redaction).** Where possible, make the log/event **type physically incapable** of holding free-form content — a struct of allowlisted scalar fields, no `payload`/`body`/`extra: any`. A type that cannot carry a phone number has no scrubber to fail; redaction (next item) is the fallback when a content field is unavoidable, not the first line of defence.
 3. **Logger-level redaction.** Configure the logger to scrub `email`, `phone`, `name`, `address`, `token`, `password`, `card_number`, `iban` keys recursively from any payload.
 4. **No raw exception payloads.** Exceptions captured by Sentry / Bugsnag must scrub the request body via the SDK's `before_send` hook.
 5. **No log-and-forget for auth flows.** Login / password-reset / token-mint logs never include the credential itself, only the actor + outcome.

package/dist/agent-src/rules/external-code-graph-interop.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "When the repo ships an external code-graph index (a graph.json-shaped artifact or a SCIP index), query IT first for codebase-structure questions — do not grep from scratch"
+description: "Repo ships a code-graph index (graph.json-shaped or SCIP) — query IT first for codebase-structure questions, do not grep from scratch"
 triggers:
   - keyword: "scip"
   - keyword: "code-graph"

package/dist/agent-src/rules/fast-path-marker-visibility.md

@@ -18,6 +18,12 @@ packs: [meta]
 
 # Fast-Path Marker Visibility
 
+When a decision resolves through the low-impact council fast-path (corpus
+match, fuzzy match, or any other `decision_resolution.classes.low_impact`
+opt-in route), the dispatcher emits a transparency marker. The host agent
+**must** surface that marker verbatim — never swallow it, never paraphrase
+it, never fold it into a same-sounding summary.
+
 ## The Iron Law
 
 ```
@@ -25,23 +31,53 @@ EVERY LOW-IMPACT COUNCIL FAST-PATH REPLY OPENS WITH THE EXACT MARKER.
 NEVER PARAPHRASE. NEVER SWALLOW. NEVER SUBSTITUTE THE AGENT'S OWN VERDICT.
 ```
 
-Markers (from `scripts/ai_council/low_impact.ts`):
+Applies to **every** fast-path outcome:
 
 - **Resolved** — `> Resolved via low-impact council fast-path: <verdict>.`
 - **Unavailable** — `> Low-impact council unavailable (no opted-in members) — escalating to user.`
 - **Split** — `> Low-impact council split — escalating to user (<m1>: X / <m2>: Y):`
 - **Aborted** — `> Low-impact council aborted (token cap) — escalating to user:`
 
-Verbatim = first non-whitespace line, English (no translation), no emoji prefix, no merged numbered-options. Marker is the only audit signal that distinguishes fast-path from local deliberation. See `.agent-src.uncondensed/rules/fast-path-marker-visibility.md` for full failure modes.
+Markers from `scripts/ai_council/low_impact.ts`. Wording is normative —
+case, punctuation, and the leading `> ` blockquote prefix all matter so
+that downstream agents and tooling can pattern-match.
+
+## What "verbatim" means
+
+- First non-whitespace line of the reply is the marker.
+- No prose, greeting, or restating-the-question above it.
+- No translation: the marker is English even when the user wrote in
+  another language. `language-and-tone` Iron-Law mirror applies to the
+  prose **after** the marker, not the marker itself.
+- No emoji decoration, no trailing rationale on the same line.
+- The marker appears **once**. Subsequent prose explains the verdict.
+
+## Why
+
+The marker is the only audit signal that distinguishes a fast-path
+resolution from the agent's own reasoning. Swallowing it converts an
+opt-in observability surface into a silent substitution — the user can no
+longer tell whether the council bypassed their judgement or the agent
+deliberated locally. This is the same failure mode that `direct-answers
+§ Iron Law 2` forbids for invented facts, applied to dispatch provenance.
 
 ## Failure modes
 
-- Opening with `Found it` / `Looks like` / `Here's the verdict` — drops the marker. **Violation.**
-- Translating the marker to non-English. **Violation.**
+- Opening with `Found it` / `Looks like` / `Here's the verdict` — drops
+  the marker. **Violation.**
+- Translating the marker to German / Spanish / any non-English. **Violation.**
 - Adding emoji prefix (`✅ Resolved via …`) — alters the literal. **Violation.**
-- Indenting beyond the leading `> ` — breaks pattern match. **Violation.**
+- Indenting the marker beyond the leading `> ` — breaks pattern match. **Violation.**
 - Merging marker into a numbered-options block. **Violation.**
 
-Scope: `low_impact` class only. `high_impact` and `user_required` never reach fast-path.
+## Scope
+
+Only fires for `low_impact` dispatch outcomes. `high_impact` and
+`user_required` classes never reach the fast-path and have no marker —
+this rule does not constrain their output.
+
+## See also
 
-See: [`ai-council-config § Low-impact council opt-in`](../docs/contracts/ai-council-config.md#low-impact-council-opt-in), [`direct-answers`](direct-answers.md) (invented-facts Iron Law kin).
+- [`ai-council-config § Low-impact council opt-in`](../docs/contracts/ai-council-config.md#low-impact-council-opt-in)
+- [`direct-answers`](direct-answers.md) — invented-facts Iron Law (provenance kin).
+- `scripts/ai_council/low_impact.ts` — marker source.

package/dist/agent-src/rules/finance-safety-floor.md

@@ -36,7 +36,7 @@ trust:
   human_review_required: true
 ---
 <!-- agent-config:human-review-banner -->
-> HUMAN REVIEW REQUIRED · trust: advisory · owner: finance
+> HUMAN REVIEW REQUIRED · trust: advisory · owner: unknown
 
 # Finance Safety Floor
 

package/dist/agent-src/rules/framework-neutrality-in-generic-skills.md

@@ -3,9 +3,9 @@ type: "auto"
 tier: "2a"
 description: "Editing a generic skill/rule/command — no single-stack mandates; carve-out pointers instead"
 triggers:
-  - path_prefix: ".agent-src.uncondensed/skills/"
-  - path_prefix: ".agent-src.uncondensed/rules/"
-  - path_prefix: ".agent-src.uncondensed/commands/"
+  - path_prefix: "src/skills/"
+  - path_prefix: "src/rules/"
+  - path_prefix: "src/agent-src/commands/"
   - keyword: "FormRequest"
   - keyword: "PHPStan"
   - keyword: "php artisan"

package/dist/agent-src/rules/history-discipline.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "Change history done right — audit coverage, cheapest-sufficient tier (default: row-level audit log; event sourcing only by waiver), audit hygiene + privacy interlocks."
+description: "Change history — audit coverage, cheapest-sufficient tier (default row-level audit log; event sourcing by waiver), hygiene + privacy interlocks"
 triggers:
   - keyword: "audit"
   - keyword: "audit log"

package/dist/agent-src/rules/legal-safety-floor.md

@@ -30,7 +30,7 @@ trust:
   human_review_required: true
 ---
 <!-- agent-config:human-review-banner -->
-> HUMAN REVIEW REQUIRED · trust: advisory · owner: legal
+> HUMAN REVIEW REQUIRED · trust: advisory · owner: unknown
 
 # Legal Safety Floor
 

package/dist/agent-src/rules/lethal-trifecta-guard.md

@@ -23,11 +23,11 @@ enforced_by:
 Prompt injection is not solvable at the model layer (OWASP LLM01). It is
 contained **architecturally**: a tool/skill/command becomes dangerous only when
 it combines all three legs of the *lethal trifecta*. Remove one leg and an
-injected instruction can do no consequential harm. This is the agentic attack
-surface OWASP's Agentic Security Initiative (ASI Top 10) catalogues — excessive
-agency, tool misuse, confused-deputy data exfiltration; the Least-Agency
-discipline in [`tool-safety`](tool-safety.md) is the same defence applied to the
-tool grant.
+injected instruction can do no consequential harm. This is the agentic
+attack surface OWASP's Agentic Security Initiative (ASI Top 10) catalogues —
+excessive agency, tool misuse, and confused-deputy data exfiltration; the
+Least-Agency discipline in [`tool-safety`](tool-safety.md) is the same defence
+applied to the tool grant.
 
 ## The Iron Law
 

package/dist/agent-src/rules/low-impact-corpus-privacy-floor.md

@@ -21,17 +21,17 @@ NO SECRETS. NO EMAILS. NO PROJECT PATHS. NO CUSTOMER NAMES.
 NO INTERNAL HOSTNAMES. NO MONEY. NO BUSINESS SQL. NO LONG CODE.
 ```
 
-Redactor lives in `scripts/ai_council/redact_low_impact_entry.ts`
+The redactor lives in `scripts/ai_council/redact_low_impact_entry.ts`
 and runs at **both** gates:
 
 1. **Write gate** — every intake append to
    `agents/decisions/low-impact-decisions.md` (Phase 12 § Step 2).
 2. **Upstream gate** — every `/memory learn-low-impact` PR draft,
-   before diff leaves repo (Phase 12 § Step 5).
+   before the diff leaves the repo (Phase 12 § Step 5).
 
-Failure at either gate refuses the operation, surfaces offending
-pattern, asks user to rephrase. Redactor never auto-rewrites — silent
-rewriting is soft gate, this is hard.
+A failure at either gate refuses the operation, surfaces the
+offending pattern, and asks the user to rephrase. The redactor never
+auto-rewrites — silent rewriting is a soft gate, this is hard.
 
 ## Forbidden-content classes (8)
 
@@ -54,9 +54,10 @@ rewriting is soft gate, this is hard.
 
 ## When to invoke
 
-- Host agent just received user intake trigger (see
+- The host agent has just received a user intake trigger (see
   `scripts/ai_council/low_impact_intake.TRIGGER_PHRASES`).
-- Host agent about to write entry to corpus or open `/memory learn-low-impact` PR.
+- The host agent is about to write an entry to the corpus or to
+  open a `/memory learn-low-impact` PR.
 
 ## What to surface on refusal
 
@@ -66,7 +67,8 @@ One-line marker:
 > Low-impact corpus refused — <category>: <snippet…>. Rephrase or skip.
 ```
 
-Then agent stops intake/upstream flow. No silent retry, no auto-rewrite.
+Then the agent stops the intake / upstream flow. No silent retry, no
+auto-rewrite.
 
 ## See also
 

package/dist/agent-src/rules/media-governance-routing.md

@@ -42,11 +42,11 @@ MEDIA POLICIES IN agents/settings/policies/media/ BEFORE EMITTING THE PROMPT TO
 THE PROVIDER. REFUSE-AND-SURFACE OVER GUESS-AND-RENDER.
 ```
 
-Routes agent to project-local media governance policy layer at [`agents/settings/policies/media/`](../../agents/settings/policies/media/) when video / image / voice surface fires. Policies are LLM-readable decision frameworks consulted in-session, not Python-enforced gates — see [`agents/settings/policies/media/README.md § Enforcement model`](../../agents/settings/policies/media/README.md) for full agent-in-the-loop contract.
+This rule routes the agent to the **project-local** media governance policy layer at [`agents/settings/policies/media/`](../../agents/settings/policies/media/) whenever a video / image / voice surface fires. The policies themselves are LLM-readable decision frameworks consulted in-session, not Python-enforced gates — see [`agents/settings/policies/media/README.md § Enforcement model`](../../agents/settings/policies/media/README.md) for the full agent-in-the-loop contract.
 
 ## What this rule surfaces
 
-Any trigger match → agent loads into context:
+When any trigger above matches in the user prompt or in a tool invocation, the agent loads into context:
 
 - [`agents/settings/policies/media/likeness.md`](../../agents/settings/policies/media/likeness.md) — real person's visual likeness.
 - [`agents/settings/policies/media/style.md`](../../agents/settings/policies/media/style.md) — named living artist's distinctive style.
@@ -56,30 +56,30 @@ Any trigger match → agent loads into context:
 - [`agents/settings/policies/media/brand-impersonation.md`](../../agents/settings/policies/media/brand-impersonation.md) — brand / broadcaster identity imitation.
 - [`agents/settings/policies/media/transparency.md`](../../agents/settings/policies/media/transparency.md) — provenance metadata (C2PA, SynthID).
 
-Each policy carries own trigger block → within active context agent narrows from superset to policies whose specific patterns actually fired (e.g. prompt naming public figure → `public-figures.md` + `disclosure.md`; `--no-disclosure` → `disclosure.md` standalone).
+Each policy carries its own trigger block, so within the active context the agent narrows from this superset to the policies whose specific patterns actually fired (e.g., a prompt naming a public figure activates `public-figures.md` and `disclosure.md`; a prompt requesting `--no-disclosure` activates `disclosure.md` standalone).
 
 ## Why project-local, not `.agent-src.uncondensed/rules/`
 
-Seven media policies live under [`agents/settings/policies/media/`](../../agents/settings/policies/media/), not as `.agent-src.uncondensed/rules/domain-safety-media-*.md`, for three reasons:
+The seven media policies live under [`agents/settings/policies/media/`](../../agents/settings/policies/media/), not as `.agent-src.uncondensed/rules/domain-safety-media-*.md`, for three reasons:
 
-1. **Consumed by skills + adapters**, not surfaced as standalone always-loaded prose. Cost non-trivial (7 × ~80 lines = ~560 lines always-context if hoisted to rules), and most sessions never touch video / image / voice surface.
-2. **Enforcement model project-local** — working precedent (`/ghostwriter:*` mandatory footer in `write-engine.md`) + audit log (session transcripts) are project artifacts. Rules under `.agent-src.uncondensed/` are tool-portable governance; these policies are domain-specific bindings.
-3. **Extraction to reusable domain pack explicitly deferred** until second non-video domain (audio, image, docs, exports) lands with overlapping execution surfaces. Until then, one-domain abstraction structurally premature — policies stay project-local, routing rule on-demand bridge.
+1. **They are consumed by skills and adapters**, not surfaced as standalone always-loaded prose. The cost is non-trivial (7 × ~80 lines = ~560 lines into the always-context if hoisted to rules), and most sessions never touch a video / image / voice surface.
+2. **The enforcement model is project-local** — the working precedent (`/ghostwriter:*` mandatory footer in `write-engine.md`) and the audit log (session transcripts) are project artifacts. Rules under `.agent-src.uncondensed/` are tool-portable governance; these policies are domain-specific bindings.
+3. **Extraction to a reusable domain pack is explicitly deferred** until a second non-video domain (audio, image, docs, exports) lands with overlapping execution surfaces. Until then, a one-domain abstraction is structurally premature — the policies stay project-local and the routing rule is the on-demand bridge.
 
-This routing rule is the bridge: sits in always-loaded rule set so trigger keywords surface project-local policies into context on demand, without paying full always-loaded cost.
+This routing rule is the bridge: it sits in the always-loaded rule set so the trigger keywords surface the project-local policies into context on demand, without paying the full always-loaded cost.
 
 ## CI reachability guarantee
 
-[`scripts/lint_media_policy_linkage.ts`](../../scripts/lint_media_policy_linkage.ts) fails build if any policy file under `agents/settings/policies/media/` not linked from:
+[`scripts/lint_media_policy_linkage.ts`](../../scripts/lint_media_policy_linkage.ts) fails the build if any policy file under `agents/settings/policies/media/` is not linked from:
 
 - this routing rule, **or**
 - a skill's `## Policies` see-also block, **or**
 - another policy file's `## See also` block.
 
-Policy that no skill, rule, or sibling policy references → silent policy. CI check is structural reachability guarantee that agent-in-the-loop model rests on.
+A policy that no skill, rule, or sibling policy references is a silent policy. The CI check is the structural reachability guarantee that the agent-in-the-loop model rests on.
 
 ## See also
 
-- [`agents/settings/policies/media/README.md`](../../agents/settings/policies/media/README.md) — full enforcement-model contract.
-- [`ask-when-uncertain`](ask-when-uncertain.md) — single-question refusal-path discipline every policy depends on.
-- [`docs/contracts/write-engine.md`](../docs/contracts/write-engine.md) — prose-disclosure precedent extended to media by [`disclosure.md`](../../agents/settings/policies/media/disclosure.md).
+- [`agents/settings/policies/media/README.md`](../../agents/settings/policies/media/README.md) — the full enforcement-model contract.
+- [`ask-when-uncertain`](ask-when-uncertain.md) — the single-question refusal-path discipline every policy depends on.
+- [`docs/contracts/write-engine.md`](../docs/contracts/write-engine.md) — the prose-disclosure precedent extended to media by [`disclosure.md`](../../agents/settings/policies/media/disclosure.md).

package/dist/agent-src/rules/media-sync-ground-truth.md

@@ -30,23 +30,41 @@ WRONG-SINGER-ON-WRONG-LINE IS A RENDER-MONEY-BURNING FAILURE.
 MAP → SIGN-OFF → RENDER. NO BLIND BATCHES.
 ```
 
-For audio-synced video (lip-sync, beat-aligned cuts, music videos), truth for **timing** + **who-sings-what** is the **actual audio** — transcribed to timestamped lines with a singer per segment. A creative skeleton (story / Drehbuch) encodes *intent*, not the delivered audio; a guessed stretch makes it worse. Lip-sync amplifies every mismatch — wrong mouth on wrong words is instantly, glaringly wrong, and the render already cost money.
+When generating audio-synced video (lip-sync, beat-aligned cuts, music
+videos), the source of truth for **timing** and **who-sings-what** is the
+**actual audio artifact** — transcribed to timestamped lines with a
+singer per segment. A creative skeleton (story / Drehbuch) encodes
+*intent*, not the *delivered* audio; a guessed stretch factor makes it
+worse. Lip-sync amplifies every mismatch — the wrong mouth on the wrong
+words is instantly, glaringly wrong, and the render already cost money.
 
 ## What this requires
 
-1. **Transcribe the real audio** → timestamped lines (OpenAI `/v1/audio/transcriptions` or whisper). Probe gives duration; transcript gives structure. Build `<project>/vocal-map.json`: `[{start, end, text, singer}]`.
-2. **Label singers onto the transcribed timeline**, never the reverse. A who-sings doc only *labels* lines; never *defines* the timeline.
-3. **Align cuts to real lyrical/musical phrases** — not arbitrary fixed-length windows.
-4. **Each vocal line lip-syncs to its OWN singer.** Never cross-assign one character's mouth onto another's part.
-5. **Sign-off gate** — surface the vocal map (timestamp → line → singer → shot) for explicit operator approval **before** any paid render.
-6. **Lip-sync sparingly** — only where a frontal close-up of the correct singer supports it; model lip-sync on singing is imperfect, so use cinematic motion (dop) for the rest.
+1. **Transcribe the real audio** → timestamped lines (OpenAI
+   `/v1/audio/transcriptions` or whisper). The probe gives duration; the
+   transcript gives structure. Build `<project>/vocal-map.json`:
+   `[{start, end, text, singer}]`.
+2. **Label singers onto the transcribed timeline**, never the reverse. A
+   who-sings doc only *labels* lines; it never *defines* the timeline.
+3. **Align cuts to real lyrical/musical phrases** — not arbitrary
+   fixed-length windows.
+4. **Each vocal line lip-syncs to its OWN singer.** Never cross-assign one
+   character's mouth onto another's part.
+5. **Sign-off gate** — surface the vocal map (timestamp → line → singer →
+   shot) for explicit operator approval **before** any paid render.
+6. **Lip-sync sparingly** — only where a frontal close-up of the correct
+   singer supports it; model lip-sync on singing is imperfect, so use
+   cinematic motion (dop) for the rest.
 
 ## Failure modes
 
-- Stretched `story.md` as singer/timing source → one character mouths another's lines (canonical odins-beard failure).
-- Fixed 5s windows landing off-phrase → jarring cuts + weird mouth motion.
-- Firing a multi-clip batch before the vocal map is approved → budget burned on throwaway output.
-- Trusting a guessed time-stretch to "match" the song length.
+- Using a stretched `story.md` as the singer/timing source → one character
+  ends up mouthing another's lines (the canonical odins-beard failure).
+- Chunking the song into fixed 5s windows that land off-phrase → jarring
+  cuts + weird mouth motion.
+- Firing a multi-clip render batch before the vocal map is approved →
+  budget burned on output that must be thrown away.
+- Trusting a guessed time-stretch factor to "match" the song length.
 
 ## See also
 

package/dist/agent-src/rules/no-cheap-questions.md

@@ -9,7 +9,7 @@ packs: [meta]
 
 # No Cheap Questions
 
-Cheap = context answers it, an option breaches an Iron Law, choices differ only in sequencing/format, or one option dominates. Mode-independent; autonomy never lifts the floor.
+Cheap = context answers it, an option breaches an Iron Law, choices differ only in sequencing/format, or one dominates. Mode-independent; autonomy never lifts the floor.
 
 ## The Iron Laws
 
@@ -19,7 +19,7 @@ NEVER OFFER AN IRON-LAW-VIOLATING OPTION.
 NEVER NUMBER CHOICES WITHOUT A REAL TRADE-OFF.
 ```
 
-Cheap-class catalog + IL 3 (no paternalistic state-assuming options): [`cheap-question-mechanics`](../contexts/execution/cheap-question-mechanics.md).
+Cheap-class catalog + IL 3 (no state-assuming options): [`cheap-question-mechanics`](../contexts/execution/cheap-question-mechanics.md).
 
 ## Iron Law 4 — No Continuation Prompts Under Autonomous Mandate
 
@@ -39,7 +39,7 @@ USER AUTHORIZES X ("COMMIT" / "PUSH" / "OPEN PR" / "DEPLOY")
 "DO THE PREREQ" vs "SKIP AND BREAK THE GATE".
 ```
 
-Prereq catalog + halt conditions: [`cheap-question-mechanics`](../contexts/execution/cheap-question-mechanics.md).
+Prereq catalog + halts: [`cheap-question-mechanics`](../contexts/execution/cheap-question-mechanics.md).
 
 ## Iron Law 6 — Destination Already Stated, Never Re-Ask
 
@@ -48,7 +48,7 @@ USER NAMED THE DESTINATION → DO NOT RE-ASK.
 NO BRANCH-BASE INVENTORY, NO "WHICH BRANCH?", NO "NEW PR?".
 ```
 
-Triggers + scope-control interaction: [`cheap-question-mechanics`](../contexts/execution/cheap-question-mechanics.md).
+Triggers + scope-control interplay: [`cheap-question-mechanics`](../contexts/execution/cheap-question-mechanics.md).
 
 ## Pre-Send Self-Check — MANDATORY before every question
 
@@ -65,8 +65,8 @@ Silent, before any numbered-options block. Any "yes" → don't ask:
 9. Prereq for user-authorized action? IL 5, execute silently.
 10. Destination (branch / PR) already named? IL 6, never re-ask.
 11. Cleanup of gitignored / auto-pruned / TTL-managed artefact? Self-managing — state inline, never offer.
-12. Numbered option contains a commit-message body, "message preview", or "Vorschlag falls Du committen willst"? Disguised commit ask — `commit-policy` violation, drop it.
-13. Commit authorized + asking "one commit or multiple?", "how should I split?", "which chunk first?"? Forbidden — `commit-policy § Always split into logical chunks`. Pick the split, state inline, execute.
-14. Artifact just landed (roadmap / ADR / plan / pitch / ticket) + offering "ready to start Phase 1?", "begin execution?", or a `/roadmap:process-*` menu? Forbidden — `scope-control § Authoring vs. implementation` + `scope-mechanics § Post-artifact hard stop`. Authoring verbs never inherit execution authorization. Emit the hand-back line, stop the turn.
+12. Numbered option carries a commit-message body, "message preview", or "Vorschlag falls Du committen willst"? Disguised commit ask — `commit-policy` violation, drop it.
+13. Commit authorized + asking "one commit or multiple?", "how should I split?", "which chunk first?"? Forbidden — `commit-policy § Always split into logical chunks`. Pick the split, state it inline, execute.
+14. Artifact just landed (roadmap / ADR / plan / pitch / ticket / design doc) + offering "ready to start Phase 1?", "begin execution?", or a `/roadmap:process-*` menu? Forbidden — `scope-control § Authoring vs. implementation` + `scope-mechanics § Post-artifact hard stop`. Authoring verbs never inherit execution authorization. Emit the hand-back line, stop the turn.
 
 Pick the dominant path, state the assumption inline, hand back. Genuine ambiguity → [`ask-when-uncertain`](ask-when-uncertain.md). In doubt → ask: this rule narrows asking, never widens silence. When asking IS allowed: [`cheap-question-mechanics`](../contexts/execution/cheap-question-mechanics.md).

package/dist/agent-src/rules/no-decorative-emojis-in-git-surfaces.md

@@ -29,24 +29,26 @@ EVERY EMOJI USED. NO LEGEND → NO EMOJI.
 EXCEPTION: USER EXPLICITLY ASKED FOR IT THIS TURN.
 ```
 
-Decorative = visual flair, ranking, mood, "look how fancy". Functional emojis below stay allowed.
+Decorative = added for visual flair, ranking, mood, or "look how
+fancy". Functional emojis below are not decorative and stay allowed.
 
 ## Surfaces — what this gates
 
-Always blocked (titles + free-standing comments):
+Always blocked (title surfaces + free-standing comment threads):
 
 - PR titles (`gh pr create --title`, `octokit.pulls.create`, PATCH).
 - Issue titles (`gh issue create`, `octokit.issues.create`, PATCH).
-- Commit subject (first line of `git commit -m` / message file).
+- Commit subject line (first line of `git commit -m` / message file).
 - Branch names.
 - Standalone PR / issue comments (`gh pr comment`, `gh issue comment`,
   `octokit.issues.createComment`) — covers everything `no-pr-progress-comments`
   lets through (review-replies, user-invoked comment flows).
 
-Body-only, legend-gated:
+Conditional, body-only — emojis allowed when a legend in the same
+artifact defines every emoji used (see below):
 
-- PR / issue descriptions (body of create / PATCH payload).
-- Commit body (lines below the blank-line subject separator).
+- PR / issue descriptions (body of the create / PATCH payload).
+- Commit body (lines after the blank-line separator below the subject).
 
 ## Universal blacklist — forbidden even with a legend
 
@@ -54,28 +56,37 @@ Body-only, legend-gated:
 🤖 🚀 🎉 ✨ 🔥 💡 👍 ❤️ 🤗 😊 (and skin-tone / variant forms)
 ```
 
-"Look how fancy" / empathy classes from `direct-answers`. Self-attribution (🤖) is the punkpeye PR (#6865 title-emoji spam) pattern. No legend rescues them.
+These are the "look how fancy" / empathy classes from `direct-answers`.
+Self-attribution (🤖) is the canonical violation pattern from the
+punkpeye PR (#6865 title-emoji spam). No legend rescues them.
 
-## Legend carve-out — when body emojis ARE allowed
+## Legend carve-out — when decorative emojis ARE allowed in a body
 
-All three must hold for the same artifact:
+Allowed only when ALL of the following hold for the same artifact:
 
-1. Body contains a `Legend:` (or `Legende:`) block on its own line defining every decorative emoji used elsewhere in the body.
-2. Emojis carry **information** (language tag, OS marker, hosting class) — not pure decoration. Example punkpeye-#6865 body:
+1. The body contains a `Legend:` (or `Legende:`) block on its own line
+   that defines every decorative emoji used elsewhere in the body.
+2. The emojis carry **information** (language tag, OS marker, hosting
+   class) — they are not pure decoration. Compare punkpeye-#6865 body:
    `📇 TypeScript · ☁️ Cloud · 🏠 Local · 🍎 macOS · 🪟 Windows · 🐧 Linux`.
 3. No universal-blacklist emoji appears (above list always wins).
 
 Body emojis without a legend → strip before posting / committing.
 
-## Whitelist — always allowed, no legend
+## Whitelist — always allowed, no legend needed
 
-- CLI / agent-status markers: `❌` `✅` `⚠️` (literal status).
+- CLI / agent-status markers: `❌` `✅` `⚠️` (carry literal status).
 - Mode markers from `role-mode-adherence`.
-- Roadmap checkbox glyphs (`[x]` `[~]` `[-]`) in fenced code or quoted roadmap excerpts — not emojis, no carve-out needed.
+- Roadmap checkbox glyphs (`[x]` `[~]` `[-]`) inside fenced code or
+  quoted roadmap excerpts — these are not emojis, no carve-out needed.
 
 ## Server-side re-injection
 
-Host AI client or tool wrapper re-injects 🤖 / 🎉 into a title or comment after creation (analog to the `Pull Request opened by …` injection in `no-attribution-footers`) → same mitigation: re-fetch after create, regex-strip, PATCH if changed, re-fetch to verify.
+If the host AI client or tool wrapper re-injects 🤖 / 🎉 into a title
+or comment after creation (analog to the `Pull Request opened by …`
+injection covered in `no-attribution-footers`), the same mitigation
+applies: re-fetch after create, regex-strip the offending characters,
+PATCH if changed, re-fetch to verify.
 
 ## Failure modes — what counts as a violation
 
@@ -83,7 +94,7 @@ Host AI client or tool wrapper re-injects 🤖 / 🎉 into a title or comment af
 - PR title `🤖 Update dependencies` — title-emoji spam (punkpeye #6865).
 - Comment body `🎉 All checks green now!` — decorative comment.
 - PR body with `Status: 🟢 Ready` — no legend, no carve-out.
-- Branch `feat/🔥-new-thing` — emoji in ref name.
+- Branch named `feat/🔥-new-thing` — emoji in ref name.
 - Body legend present but body also uses 🤖 — universal blacklist wins.
 
 ## See also
@@ -95,5 +106,5 @@ Host AI client or tool wrapper re-injects 🤖 / 🎉 into a title or comment af
   that does get posted.
 - [`commit-conventions`](commit-conventions.md) — Conventional Commits
   format; this rule narrows the allowed character set in the subject.
-- [`direct-answers`](direct-answers.md) § Emoji Scope — chat-reply analog;
-  same emoji classes, different surface.
+- [`direct-answers`](direct-answers.md) § Emoji Scope — the chat-reply
+  analog; same emoji classes, different surface.

package/dist/agent-src/rules/non-destructive-by-default.md

@@ -23,22 +23,22 @@ NO AUTONOMY SETTING, NO ROADMAP STEP, NO STANDING INSTRUCTION,
 NO "JUST KEEP GOING" CAN BYPASS IT.
 ```
 
-Triggers below require explicit user confirmation **on this turn** — not from a previous turn, not from a roadmap, not from a standing autonomy directive (anchor list: [`autonomous-execution`](autonomous-execution.md)):
+Triggers below require explicit user confirmation **on this turn** — not a previous turn, not a roadmap, not a standing autonomy directive (anchor: [`autonomous-execution`](autonomous-execution.md)):
 
 | Trigger | Examples |
 |---|---|
 | **Production-branch merge** | `main`, `master`, `prod`, `production`, `release/*`, or any project-marked deployment trunk |
-| **Commit on a production branch** | any `git commit` while `HEAD` is on a prod trunk. **Verify branch before every commit** — `main` is opt-in only, never inferred from a prior turn or a merged PR that left HEAD on `main` |
+| **Commit on a production branch** | any `git commit` while `HEAD` is on a prod trunk. **Verify branch before every commit** — `main` is opt-in only, never inferred from a prior turn or a merged PR that left HEAD there |
 | **Deploy / release** | prod `terraform apply` / `kubectl apply`, deploy scripts, release commands, CI-deploying tag pushes |
 | **Push to remote** | any `git push` (also covered by [`scope-control`](scope-control.md), restated so the floor never weakens) |
 | **Production data / infra** | prod DB writes / migrations, prod config, secrets rotation, IAM / role / policy, DNS, anything in a `prod`-scoped path or pipeline |
 | **Whimsical / unscoped bulk deletion** | `rm -rf <dir>`, `git rm -r`, glob deletes, `DROP TABLE`, `TRUNCATE`, `git reset --hard` past unpushed work — when **not required** by the task (task-aligned WIP deletions allowed, below) |
 | **Commit containing bulk deletions or infra changes** | diff removes a directory, deletes ≥5 unrelated files, or touches Terraform/Pulumi/k8s/Ansible/cloud-config — surface the diff + confirm even when [`commit-policy`](commit-policy.md) authorizes |
-| **Irreversible external action** | **send** / **publish** / **post** / **purchase** / **submit** — an outbound, externally-visible, or money-moving action the user cannot un-see: send an email/message, publish or post content, submit a form, place an order or payment. Also gated by [`scope-control`](scope-control.md) external-comms; named here so the Hard Floor lists the actual buttons |
+| **Irreversible external action** | **send** / **publish** / **post** / **purchase** / **submit** — outbound, externally-visible, or money-moving actions the user cannot un-see: email/message, publish or post content, submit a form, place an order or payment. Also gated by [`scope-control`](scope-control.md) external-comms; named here so the Hard Floor lists the actual buttons |
 
 Standing "just keep going" + next step crosses the floor → STOP, surface it (one numbered-options block per [`user-interaction`](user-interaction.md)), wait.
 
-**Never act while asking.** The ask and the action are strictly sequential: surface the confirmation, then WAIT for the answer. Never fire the action in the same turn you ask for it — no do-then-ask race, no "I went ahead and…". **The approval names the exact object** so the user confirms the real thing, not a category: a download names filename + size + source; a purchase names amount + card-last4 + total; a send names recipient + subject. Shape per [`user-interaction`](user-interaction.md) numbered-options.
+**Never act while asking.** Ask and action are strictly sequential: surface the confirmation, then WAIT. Never fire the action in the turn you ask — no do-then-ask race, no "I went ahead and…". **The approval names the exact object**, not a category: a download names filename + size + source; a purchase names amount + card-last4 + total; a send names recipient + subject. Shape per [`user-interaction`](user-interaction.md) numbered-options.
 
 ## Not in scope — deterministic regeneration
 
@@ -46,7 +46,7 @@ Output regenerated from a tracked source (condensation, code-gen, formatters, lo
 
 ## Bulk deletions during WIP — allowed if task-connected
 
-Deletions inside an **active, user-stated task** are allowed in the working tree — the Hard Floor moves to the **commit** (row 6). Whimsical / drive-by / unnamed-scope deletions still trip the floor on the edit. Allowed/forbidden lists: [`destructive-mechanics`](../contexts/authority/destructive-mechanics.md).
+Deletions inside an **active, user-stated task** are allowed in the working tree — the Hard Floor moves to the **commit** (row 6). Whimsical / drive-by / unnamed-scope deletions still trip the floor on the edit. Lists: [`destructive-mechanics`](../contexts/authority/destructive-mechanics.md).
 
 ## Failure modes
 
@@ -59,21 +59,3 @@ Applies on every surface — web, Skills API, any cloud agent. No "cloud overrid
 ## See also
 
 [`autonomous-execution`](autonomous-execution.md) · [`commit-policy`](commit-policy.md) · [`scope-control`](scope-control.md) · [`user-interaction`](user-interaction.md).
-
-## Enforcement — stated honestly (`enforced_by: none`)
-
-This floor has **no mechanical backstop**, and pretending otherwise would be the
-failure it exists to prevent. No script can enforce "ask before you deploy" — the
-obligation is to pause and surface, and the only thing that observes it is the
-human in the loop. Adjacent hooks (`block-no-verify`) guard hook-bypass, not
-destructive intent; claiming them here would inflate coverage, so they are not
-claimed.
-
-So this rule is load-bearing **and** unenforced. It is carried by the model
-honouring it — which is why it is a kernel rule, why it is short, and why it is
-counted as uncovered in the enforcement-coverage report rather than excluded
-from it.
-
-## See also
-
-[`autonomous-execution`](autonomous-execution.md) · [`commit-policy`](commit-policy.md) · [`scope-control`](scope-control.md) · [`user-interaction`](user-interaction.md).

package/dist/agent-src/rules/onboarding-gate.md

@@ -14,10 +14,20 @@ enforced_by:
 
 # Onboarding Gate
 
-**Iron Law.** First turn of project: if `onboarding.onboarded` is false in `.agent-settings.yml`, instruct dev to run `agent-config setup` in terminal before any other request. Wizard writes `onboarding.onboarded: true` on `Finish` → rule silenced after.
+**Iron Law.** First turn of a project: if `onboarding.onboarded` is
+false in `.agent-settings.yml`, instruct the developer to run
+`agent-config setup` in their terminal before executing any other
+request. The wizard writes `onboarding.onboarded: true` on `Finish`,
+which silences this rule for subsequent turns.
 
-`agent-config setup` boots local TypeScript server (Fastify on `127.0.0.1`), opens browser wizard at `/#/wizard`. No chat-side skill — legacy `/onboard` and its `onboard:finish` bridge have been retired; browser wizard is sole onboarding surface.
+`agent-config setup` boots the local TypeScript server (Fastify on
+`127.0.0.1`) and opens the browser wizard at `/#/wizard`. The chat
+side has no equivalent skill — the legacy `/onboard` skill and its
+`onboard:finish` bridge have been retired; the browser wizard is the
+sole onboarding surface.
 
-Cloud surfaces without settings file stay inert: rule does not fire when `.agent-settings.yml` absent → headless / read-only contexts (Cloudflare MCP, doc preview, CI) never see prompt.
+Cloud surfaces without a settings file stay inert: the rule does not
+fire when `.agent-settings.yml` is absent, so headless / read-only
+contexts (Cloudflare MCP, doc preview, CI) never see the prompt.
 
-Trigger-set above activates routing on demand, independent of the discipline profile (ADR-110).
+Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/persona-governance.md

@@ -3,7 +3,7 @@ type: "auto"
 tier: "2a"
 description: "Creating/editing/proposing personas — enforce per-domain cap (≤ 2 specialists), ≥ 1 skill citation, deprecation path"
 triggers:
-  - path_prefix: ".agent-src.uncondensed/personas/"
+  - path_prefix: "src/agent-src/personas/"
   - path_prefix: "dist/agent-src/personas/"
   - keyword: "persona"
   - keyword: "personas"
@@ -46,6 +46,6 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 ## See also
 
 - [`docs/contracts/persona-schema.md`](../docs/contracts/persona-schema.md) — schema lock, tiers, sections, size budgets, linter enforcement surface, and the migrated governance checks (§ 8).
-- [`docs/personas.md`](../docs/personas.md) — active persona catalog, citation map, ownership column.
+- [`docs/personas.md`](../../docs/personas.md) — active persona catalog, citation map, ownership column.
 - [`ai-council`](../skills/ai-council/SKILL.md) — neutral second-opinion mechanism used for merge / deprecation decisions.
 - [`skill-quality`](skill-quality.md) — sibling discipline rule for skill files.