@event4u/agent-config 9.9.0 → 9.11.0

package/dist/agent-src/rules/prefer-enums-over-literals.md

@@ -2,7 +2,7 @@
 type: "auto"
 tier: "2b"
 alwaysApply: false
-description: "Modeling a field/property with multiple non-boolean states — prefer an enum over bare string/numeric literals; found old-style literals where an enum fits → note, finish the task, ask after"
+description: "Field with multiple non-boolean states — prefer an enum over string/numeric literals; old-style literals found → note, finish the task, ask after"
 triggers:
   - intent: "modeling a field with multiple states"
   - intent: "adding a status or type field"
@@ -17,7 +17,7 @@ packs: [engineering-base]
 
 # Prefer Enums Over Literal Values
 
-When a field/property holds **two or more non-boolean states** — strings (`'active'`, `'pending'`, `'archived'`) or meaningful numeric codes (priority `1`/`2`/`3`, tier levels) — model it as an **enum**, not a bare string/int. An enum names the value in code (readable), makes it greppable + safe to rename, gives exhaustiveness/typo safety, and makes filtering + editing relations far easier than raw literals scattered across the codebase.
+When a field or property can hold **two or more non-boolean states** — strings (`'active'`, `'pending'`, `'archived'`) or meaningful numeric codes (priority `1`/`2`/`3`, tier levels) — model it as an **enum**, not a bare string/int. An enum names the value in code (readable), makes the value greppable and safe to rename, gives exhaustiveness/typo safety, and makes filtering and editing relations far easier than raw literals scattered across the codebase.
 
 ## The Iron Law
 
@@ -35,26 +35,26 @@ FOUND OLD-STYLE LITERALS WHERE AN ENUM FITS? NOTE IT, FINISH THE TASK, THEN ASK
 
 ## Do NOT force an enum when
 
-- A boolean (`true`/`false`) — a flag, not an enum.
+- A boolean (`true`/`false`) — that's a flag, not an enum.
 - Open/unbounded free text — name, description, URL, comment.
 - A genuine numeric **quantity** used in arithmetic — price, count, age, bytes.
 - A set owned entirely by a volatile external system — unless you map it to your own enum at the boundary.
 
 ## How (framework-neutral)
 
-- Use the language's native construct: backed enum (PHP `enum Status: string`), string-literal union or `enum` (TypeScript), `enum.Enum` (Python), an enum/`CHECK`-constrained column or lookup table + FK (database).
+- Use the language's native construct: a backed enum (PHP `enum Status: string`), a string-literal union or `enum` (TypeScript), `enum.Enum` (Python), an enum/`CHECK`-constrained column or a lookup table + FK (database).
 - Persist the enum's backing value; reference the **named case** in code, never the raw literal.
 
 ## Found old-style literals where an enum fits — defer, do not disrupt
 
-Apply exactly this order so the current task's flow is never interrupted:
+The proactive part — apply exactly this order so the current task's flow is never interrupted:
 
-1. **While doing the actual task**, if you pass code using raw string/numeric literals for a multi-state field where an enum fits, do **NOT** refactor inline (a drive-by edit — see `minimal-safe-diff`) and do **NOT** stop to ask mid-flow.
+1. **While doing the actual task**, if you pass code using raw string/numeric literals for a multi-state field where an enum would be better, do **NOT** refactor it inline (that is a drive-by edit — see `minimal-safe-diff`) and do **NOT** stop to ask mid-flow.
 2. **Note the site** — file:line + the literal set — in your working notes.
-3. **After the actual task is delivered**, surface the noted candidates as **one** numbered-options prompt (per `user-interaction`): list each enum-candidate site, ask whether to replace — all / selected / none.
-4. **Only on an explicit yes** do you refactor, as a **separate change** with its own scope (`downstream-changes` applies — update every caller, migration, test, serializer).
+3. **After the actual task is delivered**, surface the noted candidates as **one** numbered-options prompt (per `user-interaction`): list each enum-candidate site, and ask whether to replace — all / selected / none.
+4. **Only on an explicit yes** do you refactor, and treat it as a **separate change** with its own scope (`downstream-changes` applies — update every caller, migration, test, serializer).
 
-If the task itself is *adding* the field, apply the enum from the start — no deferral; the defer-and-ask flow is only for pre-existing literals you encounter.
+If the task itself is *adding* the field, apply the enum from the start — no deferral needed; the defer-and-ask flow is only for pre-existing literals you happen to encounter.
 
 ## See also
 

package/dist/agent-src/rules/preservation-guard.md

@@ -52,7 +52,10 @@ want. What's forbidden is **deletion**: the rationale paragraph stays, the
 canonical-failure example stays, every "NEVER X" bullet stays.
 
 `scripts/check_condensation.ts` enforces these mechanically — any violation is
-an `error`, not a warning.
+an `error`, not a warning. Since ADR-201 it enforces them the strongest way
+available: byte-exactness between source and projection. Structural findings
+(lost heading, mangled fence, dropped passage) are retained as diagnostics that
+name *what* differs when the bytes do.
 
 ## Mandatory preservation checklist
 
@@ -86,7 +89,12 @@ Before completing any transformation, verify:
 - Skill merges (combining two skills into one)
 - Skill splits (extracting part of a skill)
 - Refactoring (restructuring without behavior change)
-- Condensation (`.agent-src.uncondensed/` → `dist/agent-src/`)
+- ~~Condensation (source tree → `dist/agent-src/`)~~ — **no longer applicable
+  (ADR-201, accepted 2026-07-29).** `.md` is copied verbatim and path-rewritten,
+  so the projection cannot drop a passage, downgrade an Iron Law heading, or
+  mangle a code block: `check_condensation` now asserts `dist == rewrite(src)`
+  byte-for-byte. The obligations below still bind every *authoring* transform in
+  this list — they simply have nothing left to police in the projection.
 - Rule consolidation
 - Guideline restructuring
 

package/dist/agent-src/rules/question-not-instruction.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "1"
-description: "A question is a request for an ANSWER, never authorization to act — answer first; never treat 'why…?' / 'can you…?' / 'what do you think?' as a green light to build, change, or execute"
+description: "A question requests an ANSWER, never authorization to act — answer first; 'why…?' / 'can you…?' is no green light to build, change, or execute"
 triggers:
   - phrase: "warum"
   - phrase: "wieso"

package/dist/agent-src/rules/roadmap-progress-sync.md

@@ -76,12 +76,12 @@ Before sending any reply that landed roadmap work:
 
 1. Did this reply land a step (code/doc saved + verification passed)?
 2. Is its checkbox flipped to `[x]` / `[~]` / `[-]` in `agents/roadmaps/<file>.md`? If no → flip, then continue.
-2b. Roadmap created/updated from an `agents/tmp/` inbox file this reply? If
-   yes → `mv` it to `agents/tmp.old/` NOW, same reply (per
-   `agents-layout § User Inbox Workflow`); point the Source line at
-   `agents/tmp.old/<name>`. Consumed inbox file left in `agents/tmp/` = rule
-   violation, not tidiness. Move ONLY the explicitly named input file(s) —
-   never sweep the rest of the inbox.
+2b. Was a roadmap created or updated from an `agents/tmp/` inbox file this
+   reply? If yes → `mv` that file to `agents/tmp.old/` NOW, same reply (per
+   `agents-layout § User Inbox Workflow`), and point the roadmap's Source
+   line at `agents/tmp.old/<name>`. A consumed inbox file left in
+   `agents/tmp/` is a rule violation, not tidiness. Move ONLY the file(s)
+   explicitly named as input — never sweep the rest of the inbox.
 3. Is regen due now per `roadmap.dashboard_regen_cadence`?
    - `per_step` → yes, always.
    - `every_5_steps` → yes when this is the 5th, 10th, … closed step in the run, or the last step of the reply.

package/dist/agent-src/rules/rule-type-governance.md

@@ -3,7 +3,7 @@ type: "auto"
 tier: "2a"
 description: "Creating/editing rules, or auditing rule types — decides when a rule should be always vs auto"
 triggers:
-  - path_prefix: ".agent-src.uncondensed/rules/"
+  - path_prefix: "src/rules/"
 routes_to:
   - "guideline:agent-infra/rule-type-governance"
 workspaces: [agent-config-maintainer]

package/dist/agent-src/rules/scale-discipline.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "Scale-safe persistence — indexes with the queries, bounded reads, safe migrations, growth budgets, thin request path, durable async. Pattern lints gate; heuristics advise."
+description: "Scale-safe persistence — indexes with the queries, bounded reads, safe migrations, growth budgets, thin request path, durable async; heuristics advise"
 triggers:
   - keyword: "migration"
   - keyword: "index"

package/dist/agent-src/rules/scope-control.md

@@ -43,7 +43,7 @@ NEW TASK NEVER INHERITS PRIOR AUTONOMY.
 ARTIFACT SAVED → HARD STOP. NEVER AUTO-OFFER EXECUTION.
 ```
 
-`create / draft / write / erstelle …` → artifact only. Execution verbs flip scope; mixed → ask. The moment the artifact lands (roadmap, ADR, plan, pitch, ticket), the turn ends — never auto-offer execution; execution needs an explicit execution verb (`implement`, `build`, `start`, `arbeite ab`) on a later turn. Detail + anti-patterns: [`scope-mechanics`](../contexts/authority/scope-mechanics.md).
+`create / draft / write / erstelle …` → artifact only. Execution verbs flip scope; mixed → ask. The moment the artifact lands (roadmap, ADR, plan, pitch, ticket), the turn ends — never auto-offer execution. Execution requires an explicit execution verb (`implement`, `build`, `start`, `arbeite ab`) on a later turn. Detail + anti-pattern catalogue: [`scope-mechanics`](../contexts/authority/scope-mechanics.md).
 
 ## Production, infrastructure, bulk-destructive — Hard Floor
 

package/dist/agent-src/rules/secret-vcs-guard.md

@@ -2,7 +2,7 @@
 type: "auto"
 tier: "2a"
 alwaysApply: false
-description: "About to write a credential into a tracked file or stage/commit one in any VCS (git/svn/hg) — STOP, show the match, ask, offer alternatives; never silently commit, never silently strip"
+description: "Writing a credential into a tracked file or committing one in any VCS (git/svn/hg) — STOP, show the match, ask, offer alternatives; never silently"
 triggers:
   - intent: "writing a credential or API key into a file"
   - intent: "committing or staging changes that may contain a secret"

package/dist/agent-src/rules/security-sensitive-stop.md

@@ -22,9 +22,17 @@ enforced_by:
 
 # Security-Sensitive Stop Rule
 
-Before editing any file that matches a security-sensitive surface, **stop and
-run a threat analysis first**. Shipping a security-sensitive change without a
-prior threat pass is the #1 driver of authorization and data-exposure bugs.
+## The Iron Law
+
+```
+A SECURITY-SENSITIVE SURFACE IS THREAT-MODELLED BEFORE THE FIRST EDIT, NEVER AFTER.
+STOP WRITING CODE. RUN THE MATCHING ANALYSIS SKILL. IMPLEMENT AGAINST ITS OUTPUT,
+NOT AGAINST YOUR FIRST INSTINCT.
+NEVER SILENTLY FALL BACK TO EDITING WITHOUT THE ANALYSIS — IF IT IS BLOCKED, ASK.
+```
+
+Shipping a security-sensitive change without a prior threat pass is the #1 driver
+of authorization and data-exposure bugs.
 
 ## What counts as security-sensitive
 
@@ -47,7 +55,7 @@ If the change touches any of these, the rule fires.
 
 ## What to do when it fires
 
-STOP writing code. Run the matching analysis skill first:
+Run the matching analysis skill first:
 
 | Change type | Analysis skill |
 |---|---|
@@ -72,10 +80,8 @@ A prior security incident on the same path is the cheapest possible
 input to a threat pass — cite any matching `id` in the analysis output
 so the required control or regression test ships with the fix.
 
-Capture the analysis output (abuse cases, missing controls, required
-negative tests) — implement against that list, not against your first
-instinct. Never silently fall back to editing without the analysis; if
-it is blocked, ask the user.
+Capture the analysis output — abuse cases, missing controls, required negative
+tests — and implement against that list.
 
 ## When NOT to fire
 
@@ -104,10 +110,10 @@ is before the first edit — this rule makes that the default path.
 
 ## Enforcement — stated honestly (`enforced_by: none`)
 
-No script can enforce "threat-model before you edit": obligation is a pre-edit
-reasoning step only the model observes (ADR-135 classifies it HIGH —
+No script can enforce "threat-model before you edit": the obligation is a
+pre-edit reasoning step only the model observes (ADR-135 classifies it HIGH —
 model-carried, honestly uncovered). Adjacent validators (`check_secret_leak`,
 `lint_agent_security`) cover neighbouring surfaces, not this stop — claiming
-them here would inflate coverage, so not claimed.
+them here would inflate coverage, so they are not claimed.
 
 See also: `threat-modeling` · `authz-review` · `data-flow-mapper` · `minimal-safe-diff` · `think-before-action` · [`untrusted-input-defense`](untrusted-input-defense.md) · [`lethal-trifecta-guard`](lethal-trifecta-guard.md) · [`secret-vcs-guard`](secret-vcs-guard.md) · [`docs/threat-model.md`](../../docs/threat-model.md).

package/dist/agent-src/rules/senior-engineering-discipline.md

@@ -2,7 +2,7 @@
 type: "auto"
 tier: "2b"
 alwaysApply: false
-description: "Writing/generating code — generalize (no overfit or tautological tests), supply the invisible cross-cutting controls the prompt didn't name, never invent an API/field/package"
+description: "Writing/generating code — generalize (no overfit/tautological tests), supply the invisible cross-cutting controls, never invent an API/field/package"
 triggers:
   - intent: "writing or generating code"
   - intent: "implementing a feature"
@@ -25,7 +25,7 @@ packs: [engineering-base]
 
 # Senior Engineering Discipline
 
-Dominant failure mode of AI-written code isn't ignorance — **omission**. Model writes happy-path code satisfying the literal task + passing shallow tests, silently drops the invisible cross-cutting controls a senior supplies from unstated context. Baseline (2025 studies): a large share of AI-generated code ships a known vulnerability even at high syntax-correctness, and automation bias makes devs trust it *more* while it's *less* safe. Write like a senior: general not overfit; invisible controls present; verified against real sources, not memory. Act like a senior **owner**, not a passive typist — work in the interest of the product, the user, and the company, especially on security and quality; see a problem → react (fix it if small and task-aligned, else ask — per [`active-remediation`](active-remediation.md)) — never look away.
+The dominant failure mode of AI-written code is not ignorance — it is **omission**. The model writes the happy-path code that satisfies the literal task and passes shallow tests, and silently drops the invisible cross-cutting controls a senior engineer supplies from context the prompt never states. Baseline (2025 studies): a large share of AI-generated code ships a known vulnerability even at high syntax-correctness, and automation bias makes developers trust it *more* while it is *less* safe. Write code the way a senior does: general, not overfit; with the invisible controls present; verified against real sources, not memory. Act like a senior **owner**, not a passive typist — work in the interest of the product, the user, and the company, especially on security and quality; when you see a problem, react (fix it if small and task-aligned, otherwise ask — per [`active-remediation`](active-remediation.md)) — never look away.
 
 ## The Iron Law
 
@@ -40,39 +40,39 @@ THE HAPPY PATH THAT PASSES ONE TEST IS NOT A FINISHED CHANGE.
 
 ### 1. Generalize — never overfit
 
-- Implementation expresses the general rule, not a special case that happens to satisfy the example. Don't hardcode a derivable value; don't branch on one literal where a rule covers all inputs; don't paste a near-duplicate where an existing abstraction fits.
-- Tests assert **general behavior**, never a fixed value or narrow regex passing only for one crafted input. Derive expected from inputs + seeded/random data — never hardcode what the code emits. Cover happy **and** boundary (empty / null / max / Unicode) **and** error **and**, on security paths, an abuse case. Lone happy-path assertion = tautology. → `skill:testing-anti-patterns`.
+- The implementation expresses the general rule, not a special case that happens to satisfy the example. Do not hardcode a value that should be derived; do not branch on one literal where a rule covers all inputs; do not paste a near-duplicate block where an existing abstraction should be reused.
+- Tests assert **general behavior**, never a fixed value or narrow regex that only passes for one crafted input. Derive expected values from the inputs and from seeded/random test data — never hardcode what the code will emit. Cover multiple cases: happy path **and** boundary (empty / null / max / Unicode) **and** error **and**, on security-sensitive paths, an abuse case. A lone happy-path assertion is a tautology, not a test. → `skill:testing-anti-patterns`.
 
 ### 2. Cover the invisible controls for what you touched
 
-Before done, assert the unmentioned cross-cutting control is present, matched to surface:
+Before the change is done, assert the cross-cutting control the prompt didn't mention is present — matched to the surface:
 
-- **endpoint / route** → authorization + tenant scope + input validation + rate limit; state-changing → CSRF + audit. (`security-sensitive-stop` gates the sensitive ones.)
-- **database query / migration** → parameterized (never string-built), tenant-scoped, transaction around multi-step writes, reversible migration (expand-contract, never bare `DROP`), index on filtered / FK columns.
-- **user-controlled render** → output-encode; never `dangerouslySetInnerHTML` / `v-html` / `innerHTML` / `eval` on non-constant input; no secret / token in client code. → `skill:frontend-render-security`.
+- **endpoint / route** → authorization + tenant scope + input validation + rate limit; state-changing route → CSRF + audit. (`security-sensitive-stop` gates the sensitive ones.)
+- **database query / migration** → parameterized (never string-built), tenant-scoped, transaction around multi-step writes, reversible migration (expand-contract, never a bare `DROP`), index on filtered / FK columns.
+- **user-controlled render** → output-encode; never `dangerouslySetInnerHTML` / `v-html` / `innerHTML` / `eval` on non-constant input; no secret or token in client code. → `skill:frontend-render-security`.
 - **file / outbound fetch** → path-confinement + SSRF allow-list; validate server-side, never client-only.
-- **infra / IaC** → least-privilege (no `Action:*` / `Resource:*`), encryption at rest, no `0.0.0.0/0` to mgmt / DB ports, no hardcoded creds; real scanner (Checkov / Trivy) is the backstop — `plan` succeeding isn't.
-- **new dependency** → verify it exists on the real registry before install (hallucinated / "slopsquatted" packages ~1 in 5 AI suggestions); pin + lockfile; CVE scan. → `skill:supply-chain-intake`.
+- **infra / IaC** → least-privilege (no `Action:*` / `Resource:*`), encryption at rest, no `0.0.0.0/0` to management / DB ports, no hardcoded creds; a real scanner (Checkov / Trivy) is the backstop — `plan` succeeding is not.
+- **new dependency** → verify it exists on the real registry before install (hallucinated / "slopsquatted" packages are ~1 in 5 AI suggestions); pin + lockfile; CVE scan. → `skill:supply-chain-intake`.
 
-Full surface→controls table + backstop greps: → `skill:ai-code-blindspots`.
+The full surface→controls table with authoring-time backstop greps: → `skill:ai-code-blindspots`.
 
 ### 3. Verify — never assert from memory
 
-No completion claim without exercising the real path (running endpoint / UI / test — not "the code looks right"). "Defined but not wired" (middleware written, never connected to the route) = **not done**. **Before pushing code / opening a PR, run a changed-files static pass — type-checker + linter scoped to the diff (`tsc --noEmit` on the touched project, linter on changed files) — even when `quality.local_auto_run` is false: a narrow probe of your own diff, NOT the suppressed full pipeline. Letting a compile/lint error hit remote CI = completion claim without evidence (the beginner error this guards).** → `verify-before-complete`, `source-discovery-gate`.
+No completion claim without exercising the real path (the running endpoint / UI / test — not "the code looks right"). "Defined but not wired" (middleware written but never connected to the route) counts as **not done**. **Before pushing code or opening a PR, run a changed-files static pass — type-checker + linter scoped to the diff (e.g. `tsc --noEmit` on the touched project, the project linter on the changed files) — even when `quality.local_auto_run` is false. This is a narrow probe of your own diff, NOT the suppressed full quality pipeline; skipping it and letting a compile/lint error hit remote CI is a completion claim without evidence (the exact beginner error this guards against).** → `verify-before-complete`, `source-discovery-gate`.
 
 ## When it fires
 
-Any turn that writes, generates, or modifies code — feature, endpoint, query, migration, component, test, seeder, dependency, infra resource.
+Any turn that writes, generates, or modifies code — a feature, endpoint, query, migration, component, test, seeder, dependency, or infra resource.
 
 ## When NOT to fire
 
-- Prose / docs / config-only edits, no code behavior.
-- One-line rename / typo / formatting.
-- User fenced the scope ("just this one line", "skip the checks").
+- Prose / docs / config-only edits with no code behavior.
+- A one-line rename / typo / formatting change.
+- The user explicitly fenced the scope ("just this one line", "skip the checks").
 
 ## Relationship to existing rules
 
-Cross-cutting **anchor**; depth lives elsewhere and this routes to it. Doesn't replace `security-sensitive-stop` (threat-model before editing auth / billing / tenant / secret paths), `minimal-safe-diff` (smallest change), `think-before-action` (analyze first), `downstream-changes` (update all callers), `output-discipline` (no placeholder / TODO code). When one fires it wins on its subject; this adds the "generalized + invisible controls?" gate on top.
+This is the cross-cutting **anchor**; the depth lives elsewhere and this rule routes to it. It does not replace `security-sensitive-stop` (stop-and-threat-model before editing auth / billing / tenant / secret paths), `minimal-safe-diff` (smallest change), `think-before-action` (analyze first), `downstream-changes` (update all callers), or `output-discipline` (no placeholder / TODO code). When one of those fires it wins on its own subject; this rule adds the "did I generalize and supply the invisible controls?" gate on top.
 
 ## See also
 

package/dist/agent-src/rules/session-canary.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "personal.canary_name is set — open every new task by addressing the user by name (liveness canary) and keep the reply-close markers (ONE end-summary, PR URL as literal last line) alive"
+description: "personal.canary_name set — open every new task by name (liveness canary); keep the reply-close markers alive (ONE end-summary, PR URL last)"
 alwaysApply: false
 triggers:
   - intent: "starting a new task or a new conversation"

package/dist/agent-src/rules/skill-quality.md

@@ -3,7 +3,7 @@ type: "auto"
 tier: "mechanical-already"
 description: "Creating/editing/reviewing skills — minimum quality standard; every skill executable, validated, self-contained"
 triggers:
-  - path_prefix: ".agent-src.uncondensed/skills/"
+  - path_prefix: "src/skills/"
 routes_to:
   - "guideline:agent-infra/skill-quality-checklist"
 workspaces: [agent-config-maintainer]

package/dist/agent-src/rules/source-confidentiality.md

@@ -35,13 +35,13 @@ RECOMMENDING OR INTEGRATING A TOOL IS FINE. DERIVATION-ATTRIBUTION IS NOT.
 A RETAINED SOURCE LINK IS STORED ENCRYPTED, NEVER IN PLAINTEXT.
 ```
 
-Tracked tree must not reveal which third-party packages seeded ideas
-(2026-06-13 source-confidentiality sweep). Git history not rewritten — rule +
-backstop guard **new** commits only.
+The tracked tree must not reveal which third-party packages seeded ideas
+(established by the 2026-06-13 source-confidentiality sweep). Git history is
+not rewritten — this rule and its backstop guard **new** commits only.
 
 ## Fires when
 
-Authoring/editing a skill, rule, command, guideline, context, ADR, doc,
+Authoring or editing a skill, rule, command, guideline, context, ADR, doc,
 roadmap, changelog, or script and about to name an external repo / project as
 something we learned from, harvested, compared against, or copied.
 
@@ -50,31 +50,33 @@ something we learned from, harvested, compared against, or copied.
 - **Recommending / integrating** a tool or registry ("install X", "submit to
   the Y registry", "wraps the Z CLI"). Naming the tool is fine.
 - **License-required attribution** for genuinely vendored Apache/MIT code —
-  the one place an upstream name legitimately stays (see `ADR-061`; vendored
-  cluster carved out in `external_sources_denylist.json`).
+  the one place an upstream name legitimately stays (see `ADR-061`; the
+  vendored cluster is carved out in `external_sources_denylist.json`).
 
 ## Required instead
 
-- Drop the source name — say "an external reference" or omit.
-- Retain a real link → encrypt via `src/scripts/_lib/link_crypto.ts` (key in
-  gitignored `.agent-settings.yml` `secrets.link_encryption_key`,
-  project-then-global).
-- **Raw named evidence** that can't be understood without the source names
+- Drop the source name — say "an external reference" or omit it.
+- To retain a real source link, encrypt it via
+  `src/scripts/_lib/link_crypto.ts` (key in the gitignored `.agent-settings.yml`
+  under `secrets.link_encryption_key`, resolved project-then-global).
+- **Raw named evidence** that cannot be understood without the source names
   (clone dumps, full competitor audits, scraped comparison tables) stays
   **local-only** — gitignored (`agents/tmp/`, `agents/.harvest-local/`), never
   tracked.
 
 ## Harvest / comparison / borrow ROADMAPS go in `agents/roadmaps/` — anonymized, not hidden
 
-Actionable harvest / comparison / borrow **roadmap** belongs in the normal
-tracked `agents/roadmaps/` dir so roadmap-progress tracks it + completion is
-visible. Tracked-safe by **anonymizing**, not hiding in `agents/.harvest-local/`:
+An actionable harvest / comparison / borrow **roadmap** belongs in the normal
+tracked `agents/roadmaps/` directory so the roadmap-progress dashboard tracks it
+and its completion is visible. Make it tracked-safe by **anonymizing**, not by
+hiding it in `agents/.harvest-local/`:
 
 - Reference sources as **Source A / B / C** (or a neutral descriptor like "an
   external operator-runtime reference") — never the repo / org / author name.
 - Retain real links as `ENC1:` tokens (`link_crypto.ts`) in a Provenance block —
   maintainer-recoverable, opaque in the tree.
-- Borrow *items* are this package's own features; never need the source name.
+- The borrow *items* are this package's own features; they never need the source
+  name in the first place.
 
 ```
 A ROADMAP THAT CITES A SOURCE IS ANONYMIZED AND TRACKED IN agents/roadmaps/.
@@ -86,12 +88,12 @@ IT IS NEVER HIDDEN IN .harvest-local/ JUST BECAUSE IT MENTIONS A SOURCE.
 
 The `check-no-external-sources` CI gate
 (`src/scripts/check_no_external_sources.ts` + `external_sources_denylist.json`)
-runs in the package CI pipeline, fails the build on any denied source token in
-a non-carve-out tracked file. Deterministic net, not a substitute for not
-writing the attribution.
+runs in the package CI pipeline and fails the build on any denied source token
+in a non-carve-out tracked file. The linter is a deterministic net, not a
+substitute for not writing the attribution in the first place.
 
 ## See also
 
-- [`source-of-truth`](source-of-truth.md) — edit `src/`, never projections.
+- [`source-of-truth`](source-of-truth.md) — edit `src/`, never the projections.
 - [`augment-edit-discipline`](augment-edit-discipline.md) — portability + cross-ref sync.
 - `src/scripts/_lib/link_crypto.ts` — encrypted link storage.

package/dist/agent-src/rules/source-of-truth.md

@@ -54,17 +54,18 @@ ALWAYS WORK IN src/ — THEN CONDENSE VIA THE /condense COMMAND.
 **STOP. Edit `src/` first. Always.** A projection is an output, not an input —
 editing one is editing build output, and the next `/condense` overwrites it.
 
-Direct edits to `dist/agent-src/` break condensation hashes, cause CI failures
-("Verify condensation hashes" step), and create drift between source and output.
+Direct edits to `dist/agent-src/` break the byte-exactness invariant
+`dist == rewrite(src)` and fail CI (the "Verify dist == rewrite(src)
+byte-for-byte" step) — a hand-edited projection is detected, not tolerated.
 
-**Condensation is ONLY done via the `/condense` command.** The command handles
-hashing, sync verification, and quality checks automatically.
+**The projection is written ONLY by the `/condense` command.** It copies every
+`.md` verbatim and applies the path rewriter; nothing has to be marked afterwards.
 
 ## Pre-review consistency checkpoints
 
 Before asking for review or creating a PR, verify derived outputs are not stale:
 
-1. Run `bash src/scripts/condense.sh --changed` — check if `src/` has changes not yet condensed
+1. Run `bash src/scripts/condense.sh --changed` — lists every projection that is out of date (`dist != rewrite(src)`)
 2. If stale files exist: run `/condense` before pushing
 3. Before merge: verify derived outputs (`dist/agent-src/`, `.augment/`, `.claude/skills/`) are regenerated
 4. Do NOT leave `dist/agent-src/` stale across review cycles

package/dist/agent-src/rules/spreadsheet-source-quality.md

@@ -1,7 +1,7 @@
 ---
 type: "auto"
 tier: "2a"
-description: "Financial data in a spreadsheet uses official sources first (IR, regulatory filings); aggregator/news/social figures need explicit permission + a cell-level unofficial mark"
+description: "Spreadsheet financial data uses official sources (IR, regulatory filings); aggregator/news/social figures need permission + cell-level unofficial mark"
 triggers:
   - keyword: "financial data"
   - keyword: "financial model"
@@ -57,5 +57,5 @@ Entering, updating, or charting **financial figures** in a spreadsheet / model.
 ## See also
 
 - [`spreadsheet-authoring`](../skills/spreadsheet-authoring/SKILL.md) — the spreadsheet surface floor this rule's sourcing discipline plugs into.
-- [`surface-agent-contracts`](../../docs/contracts/surface-agent-contracts.md) — the spreadsheet surface's invariants + truth source.
+- [`surface-agent-contracts`](../docs/contracts/surface-agent-contracts.md) — the spreadsheet surface's invariants + truth source.
 - [`finance-safety-floor`](finance-safety-floor.md) — the finance-pack advisory floor (not-investment-advice, sensitivity) this complements.

package/dist/agent-src/rules/strategy-safety-floor.md

@@ -35,7 +35,7 @@ trust:
   human_review_required: true
 ---
 <!-- agent-config:human-review-banner -->
-> HUMAN REVIEW REQUIRED · trust: advisory · owner: founder
+> HUMAN REVIEW REQUIRED · trust: advisory · owner: unknown
 
 # Strategy Safety Floor
 

package/dist/agent-src/rules/think-before-action.md

@@ -56,9 +56,9 @@ tasks; light touch on a strong-reasoning host).
 **Ground the harness, not just the code.** Beyond structural facts (schema, API,
 DTO — the `source-discovery-gate`), ground the *runtime harness* before acting:
 which tools and host capabilities are actually available, whether a native effort
-knob exists, whether the credentials / permissions the task needs are present. A
-task assuming a tool or credential it never confirmed designs against an
-assumption exactly as a hallucinated field does — a missing-capability discovery
-is cheaper before the first action than after a failed one. (Native-harness
-behavior on the strongest host; made explicit so it holds on every host this
+knob exists, and whether the credentials / permissions the task needs are present.
+A task that assumes a tool or credential it never confirmed is designing against
+an assumption exactly as a hallucinated field is — a missing-capability discovery
+is cheaper before the first action than after a failed one. (A native-harness
+behavior on the strongest host; made explicit here so it holds on every host this
 package projects to.)

package/dist/agent-src/rules/token-budget-discipline.md

@@ -56,7 +56,9 @@ A skill claiming `rich` MUST satisfy ALL three:
 
 ## Telegraph-speak amendment
 
-The `telegraph-speak` rule (Tier 1, always-on) **exempts** skills marked
+The telegraph-speak rule is **dormant by default** — absent
+`telegraph.speak` it does not project at all, so there is nothing to exempt
+from. Where a consumer has enabled it, it **exempts** skills marked
 `token_budget_class: rich`. When such a skill is active:
 
 - Do not apply telegraph-speak condensation to its guidance prose
@@ -109,10 +111,10 @@ These skills are approved `rich` by this roadmap's council:
 
 - `tokens.rich_skills` setting in `.agent-settings.yml` (consumer override)
 - `lint_token_budget_discipline.ts` (cap + justification CI check)
-- `telegraph-speak.md` (amended to except rich-tagged skills)
+- the telegraph-speak rule, where enabled (amended to except rich-tagged skills)
 
 ## See also
 
 - `token_budget_class` key in `src/scripts/schemas/skill.schema.json`
 - `tokens.rich_skills` in `src/config/agent-settings.template.yml`
-- `telegraph-speak` rule — the frugality canon this rule amends
+- the telegraph-speak rule, where enabled — the frugality canon this rule amends

package/dist/agent-src/rules/token-efficiency.md

@@ -33,9 +33,9 @@ When a tool returns a value (branch name, file path, PR number), use that EXACT
 ## API-dollar levers
 
 Large stable context reused across turns (caching), non-interactive bulk
-cohorts (batch), or cost-aware model/effort decision → route via
+cohorts (batch), or a cost-aware model/effort decision → route via the
 [`token-optimizer`](../skills/token-optimizer/SKILL.md) index branch
-(`api-cost-levers` row) — single source of truth for billing levers.
+(`api-cost-levers` row) — single source of truth for the billing levers.
 
 ## Mechanics
 

package/dist/agent-src/rules/untrusted-input-defense.md

@@ -64,10 +64,10 @@ delegating unbounded execution of everything the task's data happens to say.
 ## Enforcement — stated honestly (`enforced_by: none`)
 
 No deterministic gate inspects fetched/tool/RAG content for injected
-instructions — quarantine is model-carried (ADR-135 lists it in the CRITICAL
-policy class precisely BECAUSE no mechanical backstop exists today; a future
-content-scanning hook is the first candidate to change this). Counting an
-adjacent lint here would be coverage inflation, so none is counted.
+instructions — the quarantine is carried by the model (ADR-135 lists it in the
+CRITICAL policy class precisely BECAUSE no mechanical backstop exists today;
+a future content-scanning hook would be the first candidate to change this).
+Counting an adjacent lint here would be coverage inflation, so none is counted.
 
 Body migrated to [`guideline:agent-infra/untrusted-input-spotlighting`](../docs/guidelines/agent-infra/untrusted-input-spotlighting.md) (per P4 of `road-to-kernel-and-router.md`) — runtime defense protocol (separate / spotlight / refuse role-takeover / no silent egress / untrusted agent-instruction files), hidden-instruction awareness (invisible Unicode + confusables), injection-signal taxonomy, least-agency → existing-gate OWASP mapping.
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/user-interaction.md

@@ -48,6 +48,13 @@ Mechanical backstop:
 (non-zero exit on any rule below). Self-scan is the primary gate;
 the script is the deterministic safety net.
 
+## Question pacing — simple vs complex
+
+- **Simple, binary, or independent questions** may be grouped into a single reply with numbered options.
+- **Complex, dependent, or branching questions** must be asked **one at a time** — one question per turn — so each answer informs the next.
+
+If in doubt, prefer one question at a time over a long batched prompt.
+
 ## Mechanics — rationale, failure modes, format details, examples
 
 The "why take a position", position-agnostic clause, format
@@ -60,3 +67,8 @@ progress indicators, and summary-table patterns all live in
 [`contexts/communication/rules-auto/user-interaction-mechanics.md`](../contexts/communication/rules-auto/user-interaction-mechanics.md).
 The rule above is the obligation surface; the mechanics file is the
 lookup material.
+
+When the user pastes large tool output, logs, JSON, or API responses,
+keep the reply narrow: extract only the relevant fields with targeted
+filters (`jq`, `rg`, `grep`) before quoting, instead of echoing the
+whole blob back.

package/dist/agent-src/rules/verify-before-complete.md

@@ -25,7 +25,7 @@ No verification command run **in this message** → you cannot claim it passes.
 
 Before claiming ANY work is complete:
 
-1. **IDENTIFY** — What command proves this claim? (tests, type-checker, linter, build — whichever the project actually runs)
+1. **IDENTIFY** — What command proves this claim? (tests, type-checker, linter, build — whichever the project runs)
 2. **RUN** — Execute the full command (fresh, complete, not cached)
 3. **READ** — Full output, check exit code, count failures
 4. **VERIFY** — Does the output actually confirm the claim?
@@ -42,15 +42,7 @@ Skip any step = the claim is unverified.
 
 ## Turn-completion — one explicit stop condition
 
-Fresh evidence answers *may I claim done*; this answers *may I end the turn*. Pair
-them: **end the turn only when the work is complete-and-verified, OR you are blocked
-on input only the user can provide.** If the last paragraph is a plan, an open
-question the context already answers, or a promise of unexecuted work ("I'll…",
-"next I will…"), that is not a stop condition — do that work now with tool calls.
-Mechanics (N=3 / Hard-Floor bounds) live in the
-[`end-of-turn checkpoint`](../contexts/execution/autonomy-mechanics.md); this
-unifies its promissory-closing half with the Gate above so "done" means *verified
-and nothing promised-but-unbuilt remains*.
+Fresh evidence answers *may I claim done*; this answers *may I end the turn*. **End the turn only when work is complete-and-verified, OR blocked on input only the user can provide.** Last paragraph a plan, an open question the context already answers, or a promise of unexecuted work ("I'll…", "next I will…") → not a stop condition; do that work now with tool calls. Mechanics (N=3 / Hard-Floor bounds): [`end-of-turn checkpoint`](../contexts/execution/autonomy-mechanics.md) — unifies its promissory-closing half with the Gate above, so "done" means *verified and nothing promised-but-unbuilt remains*.
 
 ## Red flags — STOP immediately
 
@@ -63,20 +55,8 @@ and nothing promised-but-unbuilt remains*.
 
 ## Verification commands
 
-Specific commands → `quality-tools` skill. Evidence-gate playbook
-(claim→command mapping, output inspection, end-of-work sequence) →
-`verify-completion-evidence` skill.
+Commands → `quality-tools`. Evidence-gate playbook (claim→command mapping, output inspection, end-of-work sequence) → `verify-completion-evidence`.
 
 ## Mechanics — when to run what, per-task evidence, confidence, break-glass
 
-When to run quality tools vs. tests, the per-task minimum-evidence table,
-confidence gating (High/Medium/Low), and the break-glass reduction live in
-[`verification-mechanics`](../contexts/execution/verification-mechanics.md) —
-pull it when the Gate fires.
-
-## Examples
-
-Wrong/right/why demos (hedged claims, trusting earlier runs,
-partial-verification creep): [`verify-before-complete-demos`](../docs/guidelines/agent-infra/verify-before-complete-demos.md).
-Outcome baseline:
-[`tests/golden/outcomes/verify_before_complete.json`](../../tests/golden/outcomes/verify_before_complete.json).
+Quality-tools-vs-tests timing, per-task minimum-evidence table, confidence gating (High/Medium/Low), break-glass reduction: [`verification-mechanics`](../contexts/execution/verification-mechanics.md) — pull when the Gate fires.

package/dist/agent-src/skills/adversarial-review/SKILL.md

@@ -29,8 +29,8 @@ Do NOT use when:
 
 **Inbound delegation:** [`decision-record`](../decision-record/SKILL.md)
 § Weighted-matrix mode delegates a scoped attack here after the weighted
-sums ("attack the winner, using the losing options' strongest criteria") —
-treat the matrix + sensitivity block as the artifact under review.
+sums ("attack the winner, using the losing options' strongest criteria")
+— treat the matrix + sensitivity block as the artifact under review.
 
 ## Procedure: Adversarial review