@event4u/agent-config 9.9.0 → 9.11.0

package/dist/agent-src/skills/authz-review/SKILL.md

@@ -19,9 +19,10 @@ packs:
 > **Grounded corpus (Tier-1 consultation):** the threat corpus's
 > `authorization` + `tenancy` rows (IDOR, mass-assignment escalation,
 > unscoped queries, sealed job context — each with negative tests) come
-> from `./scripts-run <skills-root>/corpus-grounding/scripts/ground ground --manifest
-> <skills-root>/threat-modeling/data/manifest.json "<check under review>"`.
-> Cite corpus rows in findings; surface the evidence gap when no row.
+> from `./scripts-run <skills-root>/corpus-grounding/scripts/ground ground
+> --manifest <skills-root>/threat-modeling/data/manifest.json "<the check
+> being reviewed>"`. Cite corpus rows in findings instead of restating from
+> memory; surface the evidence gap when the corpus has no row.
 
 > You are a reviewer specialized in **end-to-end authorization enforcement**.
 > Your only job is to walk a request path from entry to response and confirm
@@ -95,13 +96,13 @@ file:line and a specific actor who can reach the gap.
 ## Broken-access-control depth
 
 Depth for the [`broken-access-control`](../../rules/broken-access-control.md)
-rule (migrated per P4 of `road-to-kernel-and-router.md`); the Iron Law and the
-three negative tests stay in the rule.
+rule (migrated here per P4 of `road-to-kernel-and-router.md`); the Iron Law and
+the three negative tests stay in the rule.
 
 Why this class dominates: the single most common — and most damaging — failure
 in real systems and in AI-written code is that you log in as one user and see
 another user's data. The login check passes, so the endpoint *feels* protected;
-the per-object ownership/tenant check is the separate line devs and AI omit —
+the per-object ownership/tenant check is a separate line that devs and AI omit —
 especially when the object id comes straight from the request. Broken Access
 Control is OWASP Web #1 (A01:2021) and API #1 (BOLA/IDOR), trivially
 scriptable, and a recurring real-world breach class — e.g. First American
@@ -109,31 +110,31 @@ Financial (885M documents exposed via sequential ids with no ownership check).
 
 ### Non-optional controls (every data-returning surface)
 
-- **Server-derived principal.** Ownership/tenant derived from the session/token, **never** from a request header/param/body the caller controls. A matching id in the request is not authorization.
+- **Server-derived principal.** Ownership/tenant is derived from the session/token, **never** from a request header/param/body the caller controls. A matching id in the request is not authorization.
 - **Ownership/tenant check on every request id** before returning data. `findById(params.id)` with no `where owner/tenant = currentPrincipal` is the canonical bug.
-- **Tenant-scoped by construction.** Every query on a tenant table carries the tenant predicate; prefer a base scope that injects it so a forgotten clause can't leak. (DSGVO: Mandantentrennung / Trennungskontrolle is a required TOM — a missing `tenant_id` filter is a compliance failure, not just a bug.)
-- **Response minimization.** Return only entitled fields — no `SELECT *` / full-object serialization leaking PII "because the model has it" (Art. 25(2)).
+- **Tenant-scoped by construction.** Every query on a tenant table carries the tenant predicate; prefer a base scope that injects it so a forgotten clause can't leak. (German DSGVO: Mandantentrennung / Trennungskontrolle is a required TOM — a missing `tenant_id` filter is a compliance failure, not just a bug.)
+- **Response minimization.** Return only the fields the caller is entitled to — no `SELECT *` / full-object serialization leaking PII "because the model has it" (Art. 25(2) by default).
 - **Property-level authz (BOPLA / mass assignment).** Reject `role` / `user_id` / `tenant_id` / `is_admin` from the request body; explicit field allow-list, never whole-body binding.
 - **Role/field-level output filtering (vertical BOPLA).** *Which* fields a principal receives depends on role + business rules — a driver role must not receive `price`; an office role must not receive the boss's `offer`. Serialize via a **role-scoped output DTO**, never the raw model / `to_json()`; sensitive fields (`price`/`cost`/`margin`/`salary`/`discount`/`offer`/internal notes) default-deny per role.
 - **No guessable public ids** on sensitive resources — UUID/ULID, not sequential integers (turns one bug into full-DB enumeration).
 
 ### Role-based field-level access — both directions (vertical BOPLA + BFLA)
 
-Object-ownership (above) is *horizontal* (may this principal touch this record). This is *vertical*: which **fields** and which **functions** a role may reach — the maintainer's case (driver ≠ price, office worker ≠ boss's offer). Depends on role + business rules, and **the server is the only boundary** — the frontend hiding a field does not protect it: the raw JSON on the wire is readable via `curl`/DevTools/a proxy (3Fun leak: a privacy toggle filtered only in the app; the server returned every user's location to a direct query).
+Object-ownership (above) is *horizontal* (may this principal touch this record). This is *vertical*: which **fields** and which **functions** a role may reach — the maintainer's case (driver ≠ price, office worker ≠ boss's offer). It depends on role + business rules, and **the server is the only boundary** — the frontend hiding a field does not protect it: the raw JSON on the wire is readable via `curl`/DevTools/a proxy (the 3Fun leak: a privacy toggle filtered only in the app; the server returned every user's location to a direct query).
 
 - **Read side (CWE-213 / Excessive Data Exposure).** Build the response from a **role-scoped output DTO** — never serialize the ORM model directly. Sensitive fields default-deny per role. A client `?fields=` selection is ergonomics, not authorization — intersect it server-side with the role's read-allowlist.
-- **Write side (CWE-915).** Bind input through a **role-scoped write-allowlist** — never the raw body. Read-allowed ≠ write-allowed: a role may *see* `status` but not *set* `status:"approved"`; two independent sets.
+- **Write side (CWE-915).** Bind input through a **role-scoped write-allowlist** — never the raw body. Read-allowed ≠ write-allowed: a role may *see* `status` but not *set* `status:"approved"`; the two allowlists are independent sets.
 - **Function level (BFLA, OWASP API #5).** A role must not reach a function/verb reserved for a higher role. Gate **every mutating verb** (POST/PUT/PATCH/DELETE), deny-by-default — not just the GET you were asked about. The admin button being hidden is not a control.
 - **Nested / GraphQL.** Field-level checks propagate to nested selections; a low-role token selecting a restricted field gets null/error, not data.
-- **Negative tests, per (role × sensitive field), both directions:** lower-role token → the field is **absent from the raw response body** (assert the body, not the UI); lower-role setting it on input → rejected/ignored, **verified by re-reading the persisted record**; every privileged verb → 403 for lower roles (403/404 on sensitive object reads).
+- **Negative tests, per (role × sensitive field), both directions:** lower-role token → the field is **absent from the raw response body** (assert the body, not the UI); lower-role setting the field on input → rejected/ignored, **verified by re-reading the persisted record**; every privileged verb → 403 for lower roles (403/404 on sensitive object reads).
 
 ### Defense-in-depth (so one miss can't leak)
 
-Stack ≥2 independent layers on sensitive data — query-level ownership scoping, a centralized default-deny policy layer (a route with no policy is denied, not silently open), and DB row-level security as the backstop for a forgotten `WHERE tenant_id`. (Merged with the pre-existing Gotcha bullet "Defense-in-depth so one miss can't leak" below — that bullet carries the concrete RLS configuration and is the stronger, operative statement.)
+Stack ≥2 independent layers on sensitive data — query-level ownership scoping, a centralized default-deny policy layer (a route with no policy is denied, not silently open), and DB row-level security as the backstop for a forgotten `WHERE tenant_id`. (Merged with the pre-existing Gotcha bullet "Defense-in-depth so one miss can't leak" below, which carries the concrete RLS configuration — that bullet is the stronger, operative statement.)
 
 ### GDPR / DSGVO — data protection by design
 
-A cross-user data leak violates **Art. 5(1)(f)** (integrity & confidentiality — a principle → higher fine tier), **Art. 25** (by design/default: default-deny + least privilege + response minimization), and **Art. 32** — which also **mandates a process for regularly testing effectiveness** of these controls (untested authz is a direct Art. 32 gap; hence the three negative tests are non-optional). A discovered live exposure is a **notifiable breach** (Art. 33, 72 h from discovery) — surface as "notify + remediate", never a silent patch. Data-protection context, not legal advice → [`privacy-review`](../privacy-review/SKILL.md), `domain-safety-pii`.
+A cross-user data leak violates **Art. 5(1)(f)** (integrity & confidentiality — a principle → higher fine tier), **Art. 25** (by design/default: default-deny + least privilege + response minimization), and **Art. 32** — which also **mandates a process for regularly testing the effectiveness** of these controls (untested authz is a direct Art. 32 gap; this is why the three negative tests are non-optional). A discovered live exposure is a **notifiable breach** (Art. 33, 72 h from discovery) — surface it as "notify + remediate", never a silent patch. This is data-protection context, not legal advice → [`privacy-review`](../privacy-review/SKILL.md), `domain-safety-pii`.
 
 ### Backstop greps (authoring-time)
 
@@ -259,4 +260,4 @@ Runtime confirmation (e.g. *"reproduce the cross-tenant read against staging"*,
   [`data-exposure-review`](../data-exposure-review/SKILL.md),
   [`judge-security-auditor`](../judge-security-auditor/SKILL.md),
   [`security`](../security/SKILL.md),
-  [`security-audit`](../security-audit/SKILL.md) — sibling review / impl skills.
+  [`security-audit`](../security-audit/SKILL.md) — sibling review / implementation skills.

package/dist/agent-src/skills/aws-infrastructure/SKILL.md

@@ -21,9 +21,9 @@ Do NOT use when:
 
 ## Procedure: Modify AWS infrastructure
 
-1. Read the `.aws/` directory (or equivalent) for env configs and templates.
+1. Read the `.aws/` directory (or equivalent) for environment configs and templates.
 2. Read CI/CD workflows (e.g., `.github/workflows/`) for the deployment pipeline.
-3. Check the env-specific vars files.
+3. Check the environment-specific vars files.
 4. **Read project-level overrides** — check `agents/overrides/skills/aws-infrastructure.md` for project-specific service names, prefixes, and infrastructure details.
 
 ## Architecture overview
@@ -43,7 +43,7 @@ Do NOT use when:
 | **ECS Fargate** | Container orchestration (no EC2 instances) |
 | **ECR** | Docker image registry |
 | **EFS** | Shared filesystem (private + public access points) |
-| **Secrets Manager** | `.env` file storage per env |
+| **Secrets Manager** | `.env` file storage per environment |
 | **IAM Roles** | OIDC-based GitHub Actions authentication |
 | **VPC** | Networking (security groups, subnets) |
 
@@ -102,7 +102,7 @@ Template variables:
 ### Authentication
 
 - GitHub Actions uses **OIDC** (no long-lived AWS credentials).
-- Role ARN is per-env in the vars file.
+- Role ARN is per-environment in the vars file.
 - `aws-actions/configure-aws-credentials` handles the OIDC exchange.
 
 ### Image tagging
@@ -144,7 +144,7 @@ See the `terraform` and `terragrunt` skills for general IaC conventions.
 
 ## Gotcha
 
-- Never hardcode AWS credentials — always use Secrets Manager or env variables.
+- Never hardcode AWS credentials — always use Secrets Manager or environment variables.
 - ECS task definitions are immutable — you create new revisions, not edit existing ones.
 - gomplate templates use `{{ }}` which conflicts with other template engines — escape carefully.
 

package/dist/agent-src/skills/blade-ui/SKILL.md

@@ -130,7 +130,7 @@ current state on the next polish round.
 
 ## Taste Dials
 
-`DESIGN.md` `## Taste Dials` → honour: Variance → layout-family spread + asymmetry; Motion → animation budget + reduced-motion posture; Density → spacing scale + info-per-viewport. Absent → follow brief's inferred dials.
+When `DESIGN.md` declares `## Taste Dials`, honour them: Variance → layout-family spread + asymmetry tolerance; Motion → animation budget + reduced-motion posture; Density → spacing scale + information-per-viewport. Absent → follow the design brief's inferred dials.
 
 ## Do NOT
 

package/dist/agent-src/skills/bug-analyzer/SKILL.md

@@ -154,18 +154,27 @@ This is especially important for:
 - Create a **failing test** that reproduces the bug.
 - Implement a **single, focused fix** — not multiple changes.
 - Consider side effects — does the fix affect other code paths?
-- Check if similar patterns exist elsewhere that need the same fix — run variant analysis below before closing.
+- Check if similar patterns exist elsewhere that need the same fix — run the
+  variant analysis below before closing the bug.
 
 #### Variant analysis — one bug found, find its siblings
 
-Root cause confirmed → sweep for variants before closing:
-
-1. **Extract the signature** — minimal code shape that makes the bug (e.g. "optional relation accessed without null check after `first()`").
-2. **Sweep** — grep/`codebase-retrieval` for the shape, not the symptom: same API misuse, same copy-pasted block, same missing guard.
-3. **Verify each hit through the false-positive gate** (§ 4 proactive mode) — matching shape whose inputs cannot reach the bad state = rejected candidate, not a variant.
-4. **Report** — confirmed variants join the fix (same commit if within `minimal-safe-diff`'s remediation carve-out) or land as noted follow-up.
-
-Worked example: root cause `$order->customer->email` crashes when customer soft-deleted. Signature: `->customer->` after unguarded relation. Sweep finds 3 more sites; 2 are variants (same nullable relation), 1 rejected (eager-loaded with `whereHas`, cannot be null there).
+Once the root cause is confirmed, sweep for variants before closing:
+
+1. **Extract the signature** — the minimal code shape that makes the bug
+   (e.g. "optional relation accessed without null check after `first()`").
+2. **Sweep** — grep/`codebase-retrieval` for the shape, not the symptom:
+   the same API misuse, the same copy-pasted block, the same missing guard.
+3. **Verify each hit through the false-positive gate** (§ 4 proactive mode)
+   — a matching shape whose inputs cannot reach the bad state is a rejected
+   candidate, not a variant.
+4. **Report** — confirmed variants join the fix (same commit if within
+   `minimal-safe-diff`'s remediation carve-out) or land as a noted follow-up.
+
+Worked example: root cause `$order->customer->email` crashes when the
+customer was soft-deleted. Signature: `->customer->` after an unguarded
+relation. Sweep finds 3 more sites; 2 are variants (same nullable relation),
+1 is rejected (eager-loaded with `whereHas`, cannot be null there).
 - Add validation/monitoring (e.g. `MonitoringHelper::captureException()`) for data quality issues.
 - Verify the fix with the test from step 1.
 
@@ -200,15 +209,24 @@ For each code path, test these scenarios mentally:
 
 ### 4. False-positive gate (proactive mode)
 
-Before a candidate enters the report, restate as one falsifiable sentence: concrete input or state that triggers it + observable wrong behavior that follows. Candidate whose trigger you cannot name = **not a finding** — trace further or drop with one-line reason.
+Before a candidate enters the report, restate it as one falsifiable sentence:
+the concrete input or state that triggers it, and the observable wrong
+behavior that follows. A candidate whose trigger you cannot name is **not a
+finding** — trace further or drop it with a one-line reason.
 
-Route verification by severity: Low/Medium finding with traced trigger reports normally (**Standard**); High/Critical finding gets devil's-advocate pass first (**Deep**) — actively try to refute (guard clause upstream? framework default? unreachable input?), report only what survives. List killed candidates one-line under *Rejected candidates* so triage is auditable.
+Route verification by severity: a Low/Medium finding with a traced trigger
+reports normally (**Standard**); a High/Critical finding gets a
+devil's-advocate pass first (**Deep**) — actively try to refute it (guard
+clause upstream? framework default? unreachable input?) and report only what
+survives. List killed candidates one-line under *Rejected candidates* so the
+triage is auditable.
 
 ### 5. Output format (proactive mode)
 
 For each bug found: **Bug** → **Location** → **Severity** → **Root Cause** → **Trigger** → **Fix** → **Confidence**
 
-Close with **Rejected candidates** — one line per looks-broken-but-benign pattern the gate killed, with traced reason.
+Close with **Rejected candidates** — one line per looks-broken-but-benign
+pattern the gate killed, with the traced reason.
 
 ## Commands
 

package/dist/agent-src/skills/code-intelligence/SKILL.md

@@ -2,7 +2,6 @@
 model_tier: inherit
 name: code-intelligence
 description: "Route codebase-structure questions (who calls X, where used, what imports, change-impact) to a code-graph first, grep fallback. Triggers 'who calls', 'where is this used', 'call graph'."
-source: package
 domain: engineering
 workspaces:
   - engineering

package/dist/agent-src/skills/code-intelligence/evals/triggers.json

@@ -0,0 +1,52 @@
+{
+    "skill": "code-intelligence",
+    "last_eval": "2026-07-30",
+    "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers DE + EN phrasings for code-graph-answerable STRUCTURE questions — callers, references, import graph, symbol change-impact, how two symbols connect. Should-not-trigger covers the near-miss neighbours (blast-radius impact narrative, source-discovery structural evidence, the refactor executor, deep codebase audit, content/semantic grep) whose vocabulary overlaps.",
+    "queries": [
+        {
+            "q": "who calls PaymentService::refund? build me the call graph",
+            "trigger": true
+        },
+        {
+            "q": "where is this helper actually used across the repo?",
+            "trigger": true
+        },
+        {
+            "q": "what breaks if I change the signature of this method — show me every referencing symbol",
+            "trigger": true
+        },
+        {
+            "q": "wer ruft diese Funktion auf und was importiert sie?",
+            "trigger": true
+        },
+        {
+            "q": "how do these two classes connect — is there a path from the controller to the mailer?",
+            "trigger": true
+        },
+        {
+            "q": "before I edit this shared trait, list every call site, queue worker, event consumer and migration it touches with file:line",
+            "trigger": false,
+            "note": "planned-edit dependency enumeration across runtime consumers, not a symbol-relation query → blast-radius-analyzer"
+        },
+        {
+            "q": "what columns does the orders table actually have before I code against it?",
+            "trigger": false,
+            "note": "structural evidence from a real DB/API source, not a code-symbol relation → source-discovery"
+        },
+        {
+            "q": "rename this class everywhere and update all the callers",
+            "trigger": false,
+            "note": "executing the change, not answering a relationship question → code-refactoring"
+        },
+        {
+            "q": "do a deep multi-pass audit of this codebase and map its architecture",
+            "trigger": false,
+            "note": "whole-project audit orchestration, not a targeted symbol lookup → universal-project-analysis"
+        },
+        {
+            "q": "find every place we log the string 'password' in the repo",
+            "trigger": false,
+            "note": "content/text search, not a symbol relationship — plain grep is correct; the skill explicitly excludes content questions"
+        }
+    ]
+}

package/dist/agent-src/skills/code-review/SKILL.md

@@ -26,17 +26,17 @@ Use this skill when:
 
 ### Mindset
 
-- **Be thorough but pragmatic** — catch real bugs, not style nitpicks tools handle.
-- **Understand intent first** — read PR description, linked ticket, commit messages before code.
-- **Check the full picture** — a service change may require test / migration / doc changes.
+- **Be thorough but pragmatic** — catch real bugs, not style nitpicks that tools handle.
+- **Understand intent first** — read the PR description, linked ticket, and commit messages before looking at code.
+- **Check the full picture** — a change in a service may require changes in tests, migrations, docs.
 - **Assume good intent** — suggest improvements, don't criticize.
 
 ### Review order
 
 1. **Understand the goal** — what is this change trying to achieve?
-2. **Detect the change-type + depth** — route to the right checklist, pick review depth (below).
-3. **Architecture** — approach sound? Right layer? Right pattern?
-4. **Correctness** — does it work? Edge cases? Error handling?
+2. **Detect the change-type + depth** — route to the right checklist and pick the review depth (below).
+3. **Architecture** — does the approach make sense? Right layer? Right pattern?
+4. **Correctness** — does it actually work? Edge cases? Error handling?
 5. **Quality** — types, naming, readability, DRY, SOLID?
 6. **Security** — input validation, authorization, injection?
 7. **Performance** — N+1 queries, missing indexes, unbounded queries?

package/dist/agent-src/skills/command-routing/SKILL.md

@@ -72,11 +72,12 @@ output — surface it as-is. The two flows are mutually exclusive at the
 state-file level: one `.work-state.json` carries one envelope at a
 time, and the engine refuses to switch mid-flight.
 
-Unified `./agent-config migrate` sweeps a legacy
+The unified `./agent-config migrate` command sweeps any legacy
 `.implement-ticket-state.json` file into the v1 `.work-state.json`
-schema as one cleanup step (see `docs/contracts/migrate-command.md`).
-Wrapper invokes it automatically when legacy file is detected;
-agents should not bypass the dispatcher.
+schema as one of its cleanup steps (see
+`docs/contracts/migrate-command.md`). The wrapper invokes it
+automatically when the legacy file is detected; agents should not
+bypass the dispatcher.
 
 ## GitHub API: Replying to PR review comments
 

package/dist/agent-src/skills/composer-packages/SKILL.md

@@ -158,7 +158,7 @@ Packages are published to a private Composer registry. Check the organization's
 ## Output format
 
 1. Package files following standard Composer structure
-2. Updated composer.json with correct autoloading and deps
+2. Updated composer.json with correct autoloading and dependencies
 3. Service provider and config publishing (if Laravel package)
 
 ## Auto-trigger keywords
@@ -177,6 +177,6 @@ Packages are published to a private Composer registry. Check the organization's
 
 - Do NOT use `*` version constraints in library packages.
 - Do NOT require specific patch versions — use `^` or `||` ranges.
-- Do NOT include dev deps in `require` — use `require-dev`.
+- Do NOT include dev dependencies in `require` — use `require-dev`.
 - Do NOT forget to run `composer validate` before publishing.
 - Do NOT publish without updating the changelog and tagging.

package/dist/agent-src/skills/condense-memory/SKILL.md

@@ -16,63 +16,65 @@ packs:
 
 # condense-memory
 
-> **Experimental.** Output-side telegraph dialect did not meet kill-criterion in [`internal/bench/reports/telegraph-v1.md`](../../../bench/reports/telegraph-v1.md) (`vs_terse` median −9.27 %). Input-side memory condensation is orthogonal use case: savings target always-loaded memory budget, not reply stream. Treat ship-criterion as **per-target measurement**, not v1 verdict.
+<!-- cloud_safe: noop -->
+
+> **Experimental.** Output-side telegraph dialect did not meet the kill-criterion in [`internal/bench/reports/telegraph-v1.md`](../../../bench/reports/telegraph-v1.md) (`vs_terse` median −9.27 %). Input-side memory condensation is an orthogonal use case: the savings target the always-loaded memory budget, not the reply stream. Treat ship-criterion as **per-target measurement**, not the v1 verdict.
 
 ## When to use
 
 Use when:
 
-- Always-loaded memory file (`AGENTS.md`, `CLAUDE.md`, `.cursorrules`, `GEMINI.md`, `.windsurfrules`) close to or above host tool's char budget and maintainer wants to recover input-token headroom.
-- Consumer-shipped `templates/AGENTS.md` failing `agents-md-thin-root` cap and pointer-extraction options exhausted.
-- Maintainer asks to "condense this memory file" or "shrink AGENTS.md" or names input-side telegraph.
+- An always-loaded memory file (`AGENTS.md`, `CLAUDE.md`, `.cursorrules`, `GEMINI.md`, `.windsurfrules`) is close to or above the host tool's char budget and the maintainer wants to recover input-token headroom.
+- A consumer-shipped `templates/AGENTS.md` is failing the `agents-md-thin-root` cap and the pointer-extraction options are exhausted.
+- The maintainer asks to "condense this memory file" or "shrink AGENTS.md" or names input-side telegraph.
 
 ## Do NOT
 
-- Condense reply, commit message, PR body, ticket summary, or any deliverable written *for* human reader — those are carve-outs in [`telegraph-speak § Carve-outs`](../../rules/telegraph-speak.md) and stay verbatim.
-- Condense path matching sensitive-file denylist (`.env*`, `.netrc`, `credentials*`, `secrets*`, `id_rsa*`, `*.pem|key|p12|pfx|crt|cer|jks`, `.ssh/*`) — script refuses with `SensitivePathError` and so should you.
-- Condense generated file (`dist/agent-src/`, `.augment/`, `.claude/`, `.cursor/`, `.clinerules/`, `.windsurfrules`) — edit source in `src/` and regenerate via package's sync + generate-tools scripts (`scripts/condense.sh --sync` + `scripts/condense.ts --generate-tools`).
-- Hand-edit condensed memory file in place — run `--decondense` first; next condense pass refuses on body-hash drift (`CondensationRefused`).
-- Commit condensed file without committing matching `.original.md` backup — round-trip breaks otherwise.
+- Condense a reply, commit message, PR body, ticket summary, or any deliverable written *for* a human reader — those are carve-outs in [`telegraph-speak § Carve-outs`](../../rules/telegraph-speak.md) and stay verbatim.
+- Condense a path matching the sensitive-file denylist (`.env*`, `.netrc`, `credentials*`, `secrets*`, `id_rsa*`, `*.pem|key|p12|pfx|crt|cer|jks`, `.ssh/*`) — the script refuses with `SensitivePathError` and so should you.
+- Condense a generated file (`dist/agent-src/`, `.augment/`, `.claude/`, `.cursor/`, `.clinerules/`, `.windsurfrules`) — edit the source in `src/` and regenerate via the package's sync + generate-tools scripts (`scripts/condense.sh --sync` + `scripts/condense.ts --generate-tools`).
+- Hand-edit a condensed memory file in place — run `--decondense` first; the next condense pass refuses on body-hash drift (`CondensationRefused`).
+- Commit the condensed file without committing the matching `.original.md` backup — round-trip breaks otherwise.
 
 ## Procedure
 
-1. **Analyse target first.** Before any write, **inspect** target with `view` or `wc -l` to confirm it is always-loaded memory file (`AGENTS.md`, `CLAUDE.md`, `.cursorrules`, `GEMINI.md`, `.windsurfrules`), not generated, and has prose paragraphs to condense (pointer-only Thin-Root file may net near-zero). Skip rest of procedure if any check fails.
-2. **Check denylist gate.** Run `./scripts-run src/scripts/condense_memory <path> --check` — exit 0 = safe; exit 2 = denylist hit, stop and surface refusal.
-3. **Record baseline.** `wc -c <path>` — capture pre-condensation char count for commit message.
-4. **Condense.** `./scripts-run src/scripts/condense_memory <path>`. Script writes `<path>.original.md` (verbatim backup) and rewrites `<path>` with `original_sha256:` + `condensed_at:` frontmatter.
-5. **Inspect diff.** Eyeball every Iron-Law fence, numbered-options block, code fence, backtick span, `❌`/`⚠️`/`✅` line, and frontmatter pair — all must be byte-identical. Body prose may have lost articles (`the`/`a`/`an`) and auxiliaries (`is`/`are`/`was`/`be`/`that`/`which`).
-6. **Validate idempotency.** Re-run `./scripts-run src/scripts/condense_memory <path>` — clean re-run is no-op (body hash matches). Non-zero exit = stop, escalate.
-7. **Commit both files together.** `<path>` and `<path>.original.md` ship as pair. Backup is rollback path; never commit one without other.
-8. **Rollback path.** If readability fails review at step 5: `./scripts-run src/scripts/condense_memory <path> --decondense` restores backup and deletes `.original.md`.
+1. **Analyse the target first.** Before any write, **inspect** the target with `view` or `wc -l` to confirm it is an always-loaded memory file (`AGENTS.md`, `CLAUDE.md`, `.cursorrules`, `GEMINI.md`, `.windsurfrules`), is not generated, and has prose paragraphs to condense (a pointer-only Thin-Root file may net near-zero). Skip the rest of the procedure if any check fails.
+2. **Check denylist gate.** Run `./scripts-run src/scripts/condense_memory <path> --check` — exit 0 = safe; exit 2 = denylist hit, stop and surface the refusal.
+3. **Record baseline.** `wc -c <path>` — capture pre-condensation char count for the commit message.
+4. **Condense.** `./scripts-run src/scripts/condense_memory <path>`. The script writes `<path>.original.md` (verbatim backup) and rewrites `<path>` with `original_sha256:` + `condensed_at:` frontmatter.
+5. **Inspect the diff.** Eyeball every Iron-Law fence, numbered-options block, code fence, backtick span, `❌`/`⚠️`/`✅` line, and frontmatter pair — all must be byte-identical. Body prose may have lost articles (`the`/`a`/`an`) and auxiliaries (`is`/`are`/`was`/`be`/`that`/`which`).
+6. **Validate idempotency.** Re-run `./scripts-run src/scripts/condense_memory <path>` — clean re-run is a no-op (body hash matches). Non-zero exit = stop, escalate.
+7. **Commit both files together.** `<path>` and `<path>.original.md` ship as a pair. The backup is the rollback path; never commit one without the other.
+8. **Rollback path.** If readability fails review at step 5: `./scripts-run src/scripts/condense_memory <path> --decondense` restores the backup and deletes `.original.md`.
 
 ## Output format
 
-Maintainer-facing report after invoking script MUST contain, in this order:
+The maintainer-facing report after invoking the script MUST contain, in this order:
 
-1. **Diff line** — pre/post `wc -c` as single line (`AGENTS.md: 2,891 → 2,453 chars (−15.1 %)`).
-2. **Backup path** — full path of `.original.md` backup so maintainer can verify it landed on disk.
-3. **Carve-out check** — one line confirming seven carve-out classes round-tripped (`carve-outs: 7 classes preserved · idempotent re-run: clean`).
-4. **Exit-code surface** — on failure, surface verbatim exit code and exception name (`SensitivePathError → exit 2`, `CondensationRefused → exit 3`, `FileNotFoundError → exit 4`); do not paraphrase.
+1. **Diff line** — pre/post `wc -c` as a single line (`AGENTS.md: 2,891 → 2,453 chars (−15.1 %)`).
+2. **Backup path** — full path of the `.original.md` backup so the maintainer can verify it landed on disk.
+3. **Carve-out check** — one line confirming the seven carve-out classes round-tripped (`carve-outs: 7 classes preserved · idempotent re-run: clean`).
+4. **Exit-code surface** — on failure, surface the verbatim exit code and exception name (`SensitivePathError → exit 2`, `CondensationRefused → exit 3`, `FileNotFoundError → exit 4`); do not paraphrase.
 
-Do **not** narrate algorithm, grammar rules, or carve-out theory — rule and this skill document contract; output reports result.
+Do **not** narrate the algorithm, the grammar rules, or the carve-out theory — the rule and this skill document the contract; the output reports the result.
 
 ## Carve-outs — byte-for-byte preserved
 
-Mirrors seven carve-out classes in [`telegraph-speak`](../../rules/telegraph-speak.md). Condensation engine in [`src/scripts/condense_memory.ts`](../../../src/scripts/condense_memory.ts) preserves:
+Mirrors the seven carve-out classes in [`telegraph-speak`](../../rules/telegraph-speak.md). The condensation engine in [`src/scripts/condense_memory.ts`](../../../src/scripts/condense_memory.ts) preserves:
 
 1. **Triple-backtick fences** — any language, any depth.
-2. **Numbered-options lines** — `^>?\s*\d+\.\s` plus `**Recommendation:**` / `**Empfehlung:**` label.
+2. **Numbered-options lines** — `^>?\s*\d+\.\s` plus the `**Recommendation:**` / `**Empfehlung:**` label.
 3. **Backtick spans** — file paths, command names, identifiers inside body prose.
 4. **Status / error markers** — lines starting with `❌`, `⚠️`, `✅`.
 5. **Iron-Law ALL-CAPS lines** — `^[A-Z][A-Z0-9 ,.\-_/']{3,}$`.
-6. **Frontmatter blocks** — `---` fence pairs at head of file.
+6. **Frontmatter blocks** — `---` fence pairs at the head of the file.
 7. **Mode markers** per [`role-mode-adherence`](../../rules/role-mode-adherence.md).
 
-Mangling any of these breaks Iron-Law surface host tool reads. Unit tests in `tests/scripts/condense_memory.test.ts` lock each carve-out class as regression case.
+Mangling any of these breaks the Iron-Law surface the host tool reads. The unit tests in `tests/scripts/condense_memory.test.ts` lock each carve-out class as a regression case.
 
 ## Idempotency contract — Step 9 guard
 
-Script is **idempotent on clean re-runs**: running it twice on same target is no-op because body hash matches recondensed hash. Script **refuses** on **body drift**:
+The script is **idempotent on clean re-runs**: running it twice on the same target is a no-op because the body hash matches the recondensed hash. The script **refuses** on **body drift**:
 
 | State | Outcome |
 |---|---|
@@ -80,11 +82,11 @@ Script is **idempotent on clean re-runs**: running it twice on same target is no
 | SHA marker present, body re-condenses to same hash | No-op (return target unchanged). |
 | SHA marker present, body hash diverged | **Refuse** with `CondensationRefused` exit 3. |
 
-If you need to edit condensed memory file, run `--decondense` first, edit restored `.original.md` content, then re-run condenseor. Never hand-edit condensed body — next CI run will either silently corrupt your edit (if it happens to re-condense to same shape) or hard-fail next condense pass.
+If you need to edit a condensed memory file, run `--decondense` first, edit the restored `.original.md` content, then re-run the condenseor. Never hand-edit the condensed body — the next CI run will either silently corrupt your edit (if it happens to re-condense to the same shape) or hard-fail the next condense pass.
 
 ## Sensitive-path gate
 
-Every read path passes through [`src/scripts/validate_safe_paths.ts`](../../../src/scripts/validate_safe_paths.ts) `assert_safe()` before bytes leave disk. Gate is security floor for Phase 2 (input-side condensation) per `step-16-telegraph-substance.md` Phase 0; rollback of gate is rollback of this skill.
+Every read path passes through [`src/scripts/validate_safe_paths.ts`](../../../src/scripts/validate_safe_paths.ts) `assert_safe()` before bytes leave disk. The gate is the security floor for Phase 2 (input-side condensation) per `step-16-telegraph-substance.md` Phase 0; rollback of the gate is rollback of this skill.
 
 CLI exit codes:
 
@@ -95,30 +97,30 @@ CLI exit codes:
 
 ## Gotchas
 
-- **Body-hash drift after manual edit** — hand-editing condensed body breaks `original_sha256:` invariant. Next condense pass refuses with `CondensationRefused` (exit 3). Recovery: `--decondense`, edit restored body, re-condense.
-- **`.original.md` backup missing on `--decondense`** — exit 4 (`FileNotFoundError`). Either someone deleted backup or `--decondense` already ran. Restore from git history; never regenerate backup by hand (regenerated content would not be byte-identical).
-- **Denylist false positive** — sensitive-looking filename outside denylist surface (project-specific naming) will still pass `assert_safe()`. Denylist necessary but not sufficient; maintainer responsible for never feeding secrets to condenseor.
-- **Frontmatter ordering with existing keys** — if target already has frontmatter, condenseor preserves existing keys, drops any prior `original_sha256:` / `condensed_at:` entries, and appends new pair. Other agents reading file should treat SHA + timestamp pair as canonical condensation marker, not file size.
-- **Negative savings on pointer-heavy files** — `templates/AGENTS.md` already following Thin-Root (≥ 40 % pointers, ≥ 60-char *why*-clauses) has little prose left to drop; condensation may net near-zero or even add bytes via frontmatter. Run [`agents-md-thin-root`](../agents-md-thin-root/SKILL.md) first to maximise pointer share, then measure whether this skill still pays.
-- **Generated-tree drift** — condensing `.agent-src.uncondensed/templates/AGENTS.md` does NOT propagate to `.augment/`, `.claude/`, etc. until package's sync + generate-tools scripts run (`scripts/condense.sh --sync` + `scripts/condense.ts --generate-tools`). Always regenerate after condensing templated file.
+- **Body-hash drift after manual edit** — hand-editing the condensed body breaks the `original_sha256:` invariant. The next condense pass refuses with `CondensationRefused` (exit 3). Recovery: `--decondense`, edit the restored body, re-condense.
+- **`.original.md` backup missing on `--decondense`** — exit 4 (`FileNotFoundError`). Either someone deleted the backup or `--decondense` already ran. Restore from git history; never regenerate the backup by hand (the regenerated content would not be byte-identical).
+- **Denylist false positive** — a sensitive-looking filename outside the denylist surface (project-specific naming) will still pass `assert_safe()`. The denylist is necessary but not sufficient; the maintainer is responsible for never feeding secrets to the condenseor.
+- **Frontmatter ordering with existing keys** — if the target already has frontmatter, the condenseor preserves existing keys, drops any prior `original_sha256:` / `condensed_at:` entries, and appends the new pair. Other agents reading the file should treat the SHA + timestamp pair as the canonical condensation marker, not the file size.
+- **Negative savings on pointer-heavy files** — a `templates/AGENTS.md` that already follows Thin-Root (≥ 40 % pointers, ≥ 60-char *why*-clauses) has little prose left to drop; condensation may net near-zero or even add bytes via frontmatter. Run [`agents-md-thin-root`](../agents-md-thin-root/SKILL.md) first to maximise pointer share, then measure whether this skill still pays.
+- **Generated-tree drift** — condensing `.agent-src.uncondensed/templates/AGENTS.md` does NOT propagate to `.augment/`, `.claude/`, etc. until the package's sync + generate-tools scripts run (`scripts/condense.sh --sync` + `scripts/condense.ts --generate-tools`). Always regenerate after condensing a templated file.
 
 ## Measurement — when to condense
 
-No published `telegraph-v2` baseline for input-side savings yet (Step 11 of `step-16-telegraph-substance.md` ships that). Until then, maintainer judges per-target whether condensation pays its readability cost. Suggested workflow:
+There is no published `telegraph-v2` baseline for input-side savings yet (Step 11 of `step-16-telegraph-substance.md` ships that). Until then, the maintainer judges per-target whether the condensation pays its readability cost. Suggested workflow:
 
 1. `wc -c <path>` before — record baseline char count.
 2. `./scripts-run src/scripts/condense_memory <path>` — condense + back up.
 3. `wc -c <path>` after — record post-condensation char count.
-4. Eyeball diff: does prose stay legible? Are all Iron-Law fences intact?
+4. Eyeball the diff: does the prose stay legible? Are all Iron-Law fences intact?
 5. If yes → commit both `<path>` and `<path>.original.md`. If no → `--decondense`.
 
-Future `telegraph-v2.md` will tabulate realised input-token saving against `agents-md-thin-root` 40 % pointer-ratio constraint so maintainer has numerical floor.
+A future `telegraph-v2.md` will tabulate the realised input-token saving against the `agents-md-thin-root` 40 % pointer-ratio constraint so the maintainer has a numerical floor.
 
 ## Cross-references
 
-- [`telegraph-speak`](../../rules/telegraph-speak.md) — runtime rule script mirrors for input-side targets; `telegraph.speak_scope` does **not** gate this script (input-side runs regardless).
+- [`telegraph-speak`](../../rules/telegraph-speak.md) — runtime rule the script mirrors for input-side targets; `telegraph.speak_scope` does **not** gate this script (input-side runs regardless).
 - [`src/scripts/validate_safe_paths.ts`](../../../src/scripts/validate_safe_paths.ts) — Phase 0 gate; ported from upstream Telegraph `63a91ec`.
 - [`src/scripts/condense_memory.ts`](../../../src/scripts/condense_memory.ts) — implementation.
 - [`tests/scripts/condense_memory.test.ts`](../../../tests/scripts/condense_memory.test.ts) — regression locks for each carve-out + idempotency + denylist.
 - [`docs/contracts/condensation-default-kill-criterion.md`](../../../docs/contracts/condensation-default-kill-criterion.md) — v1 verdict (output-side; informs but does not gate this skill).
-- [`agents-md-thin-root`](../agents-md-thin-root/SKILL.md) — caps consumer-shipped `templates/AGENTS.md`; this skill is one tool to land under cap.
+- [`agents-md-thin-root`](../agents-md-thin-root/SKILL.md) — caps the consumer-shipped `templates/AGENTS.md`; this skill is one tool to land under the cap.

package/dist/agent-src/skills/context-document/SKILL.md

@@ -70,9 +70,9 @@ agents/settings/contexts/                                # Project-wide contexts
 | **Integration** | External API/system integration | `probaus-api.md` |
 | **Infrastructure** | DevOps or infrastructure concern | `queue-system.md` |
 | **Knowledge card** | Trust-tiered cache of *expensive* (remote) structural evidence — negative facts + pointers durable, positive structure a hypothesis | `lodash.md`, `stripe-api.md` |
-| **Standards card (Class A)** | Coding standards **derived from real tooling config** — pointer + digest, `trust: high (config-derived)`, auto-refreshed when config changes; never a flattened claim | `coding-standards.md` (points at `ruff.toml`, `.editorconfig`) |
-| **Lesson card (Class C)** | Learned lesson — `symptom` (fact) split from `hypothesis` (decaying theory), `trust: low`, subject-not-person, anti-calcification decay; promoted only via human gate (accumulation layer is eval-gated) | `agents/memory/curated/lessons/<slug>.md` |
-| **Knowledge page (typed)** | Team-shared, lifecycle-typed knowledge grown while working the project — episodic sessions, semantic concepts, procedures on the way to a skill, small decisions | `agents/knowledge/concepts/api-response-shape.md` |
+| **Standards card (Class A)** | Coding standards **derived from real tooling config** — pointer + digest, `trust: high (config-derived)`, auto-refreshed when the config changes; never a flattened claim | `coding-standards.md` (points at `ruff.toml`, `.editorconfig`) |
+| **Lesson card (Class C)** | A learned lesson — `symptom` (fact) split from `hypothesis` (decaying theory), `trust: low`, subject-not-person, anti-calcification decay; promoted only via the human gate (accumulation layer is eval-gated) | `agents/memory/curated/lessons/<slug>.md` |
+| **Knowledge page (typed)** | Team-shared, lifecycle-typed knowledge that grows while working a project — episodic sessions, semantic concepts, procedures on their way to a skill, small decisions | `agents/knowledge/concepts/api-response-shape.md` |
 
 ## Where to store contexts
 
@@ -86,19 +86,6 @@ agents/settings/contexts/                                # Project-wide contexts
 | **Evidence Report / probe dumps / absence log** (ephemeral) | `agents/memory/knowledge/session/` (gitignored, overwritten each task) |
 | If unsure | Ask the user |
 
-### Standards cards — Class A configured convention (Evidence v2)
-
-A **standards card** is a present-state context whose claims are **derived from the
-project's real tooling config** (`.editorconfig`, `eslint.config.js`, `pint.json`,
-`pyproject.toml`/`ruff.toml`, commit-lint, CI lint steps). It is `trust: high
-(config-derived)` — high *because* the config is the truth. Each standard is a
-**pointer + digest** (value + `source: file:key` + scope), never a flattened claim;
-conflicting configs surface as two pointers, never merged. Digest is **regenerated**
-when a source config's mtime/hash changes (auto-refresh, no human gate). Read for
-heuristics only, never to bypass a fresh structural read. Build with
-[`standards-from-config`](../standards-from-config/SKILL.md) skill; store under
-`agents/settings/contexts/`.
-
 ### Knowledge cards — a specialized, evidence-disciplined context type
 
 A **knowledge card** extends this mechanism for the evidence-first discipline; it
@@ -117,17 +104,32 @@ for the full model.
 ### Knowledge pages — the typed sibling directories
 
 Alongside knowledge cards, `agents/knowledge/{sessions,concepts,procedures,decisions}/`
-holds team-shared knowledge grown **while working the project** — coding
-standards observed, module structure, API endpoint shapes, recurring
+holds team-shared knowledge that grows **while working the project** —
+coding standards observed, module structure, API endpoint shapes, recurring
 mistakes, small decisions not big enough for an ADR. Fill new pages from the
 [`knowledge-pages`](../../agent-src/templates/contexts/knowledge-pages.md)
 template.
 
 **Retrieval protocol — index-first, then grep, then read.** Read
 `agents/knowledge/INDEX.md` first (one line per page, regenerated by
-`src/scripts/generate_knowledge_index.ts`); `grep` keywords second; read the
-specific file third. Never enumerate every knowledge file directly — no
-search infrastructure by design.
+`src/scripts/generate_knowledge_index.ts`); `grep` for keywords second; read
+the specific file third. Never enumerate every knowledge file directly —
+there is no search infrastructure by design.
+
+### Standards cards — Class A configured convention (Evidence v2)
+
+A **standards card** is a present-state context whose claims are **derived from
+the project's real tooling config** (`.editorconfig`, `eslint.config.js`,
+`pint.json`, `pyproject.toml`/`ruff.toml`, commit-lint, CI lint steps). It is
+`trust: high (config-derived)` — high *because* the config is the truth, not
+because the agent believes it. Each standard is a **pointer + digest** (value +
+`source: file:key` + scope), never a flattened claim; conflicting configs are
+surfaced as two pointers, never merged. The digest is **regenerated** when a
+source config's mtime/hash changes (auto-refresh, no human gate — Class A is
+deterministic) and is read for heuristics only, never to bypass a fresh
+structural read. Build it with the
+[`standards-from-config`](../standards-from-config/SKILL.md) skill; store under
+`agents/settings/contexts/`.
 
 ### Shared vs. project-specific contexts
 

package/dist/agent-src/skills/copilot-config/SKILL.md

@@ -26,6 +26,11 @@ Do NOT use when:
 
 ## Procedure: Configure Copilot
 
+1. **Inspect current Copilot config** — Read `.github/copilot-instructions.md` (if any) and the *What Copilot Can and Cannot Read* table below to confirm Copilot Code Review vs. Chat scope.
+2. **Decide self-contained scope** — Identify which rules must live in `copilot-instructions.md` (PR-review-relevant) vs. `.augment/` (agent-only).
+3. **Apply changes** — Edit `copilot-instructions.md` with coding-standards, review-comment rules, and any new conventions; keep it self-contained.
+4. **Verify** — Open a draft PR, confirm Copilot reads the new rules; for Chat, ask Copilot to summarize the active instructions.
+
 ### Configuration File
 
 **`.github/copilot-instructions.md`** — the single source of truth for Copilot behavior.
@@ -191,7 +196,7 @@ Copilot and Augment complement each other:
 ## Gotcha
 
 - copilot-instructions.md is for GitHub Copilot, NOT for Augment — don't mix audiences.
-- Don't duplicate .augment/ content into copilot-instructions.md — it bloats the file and → drift.
+- Don't duplicate .augment/ content into copilot-instructions.md — it bloats the file and causes drift.
 - Copilot reads the ENTIRE instructions file on every request — keep it under 500 lines.
 
 ## Do NOT