@event4u/agent-config 9.9.0 → 9.11.0

package/dist/agent-src/skills/laravel-pennant/SKILL.md

@@ -186,7 +186,7 @@ Feature::for($users)->load(['new-dashboard', 'advanced-reporting']);
 
 ## Gotcha
 
-- Feature flags in DB driver require migration — don't forget `php artisan pennant:purge` for cleanup.
+- Feature flags in database driver require migration — don't forget `php artisan pennant:purge` for cleanup.
 - The model tends to check flags without a scope — always pass the authenticated user or a default scope.
 - Don't nest feature flag checks — it makes the logic impossible to reason about.
 

package/dist/agent-src/skills/laravel-pulse/SKILL.md

@@ -26,10 +26,11 @@ Use this skill when working with Laravel Pulse:
 
 ## Procedure: Set up Pulse
 
-1. **Install** — `composer require laravel/pulse`, publish config, run migrations.
-2. **Configure** — Set up recorders in `config/pulse.php`.
-3. **Add dashboard** — Register route and authorize access.
-4. **Verify** — Visit `/pulse` dashboard, confirm data is being recorded.
+1. **Inspect current monitoring** — Check `composer.json`, existing telemetry packages, and `config/` for Pulse, Telescope, or Horizon already installed; identify gaps.
+2. **Install** — `composer require laravel/pulse`, publish config, run migrations.
+3. **Configure** — Set up recorders in `config/pulse.php`.
+4. **Add dashboard** — Register route and authorize access.
+5. **Verify** — Visit `/pulse` dashboard, confirm data is being recorded.
 
 ### Installation
 
@@ -136,9 +137,9 @@ Pulse::record('api_call', 'stripe', 250)  // type, key, value
 
 ## Core rules
 
-- **Trim old data** — configure retention to prevent DB bloat.
+- **Trim old data** — configure retention to prevent database bloat.
 - **Use sample rates** in production — not every request needs recording.
-- **Separate DB** — consider a dedicated DB connection for Pulse data.
+- **Separate database** — consider a dedicated DB connection for Pulse data.
 - **Restrict access** — always gate the dashboard behind authentication.
 - **Monitor what matters** — don't enable all recorders if you don't need them.
 
@@ -158,7 +159,7 @@ Pulse::record('api_call', 'stripe', 250)  // type, key, value
 
 ## Gotcha
 
-- Pulse stores data in the same DB by default — configure a separate connection for production.
+- Pulse stores data in the same database by default — configure a separate connection for production.
 - The model forgets that Pulse data is sampled, not exact — don't use it for billing or exact counts.
 - Custom recorders must be registered in a service provider — they don't auto-discover.
 
@@ -167,4 +168,4 @@ Pulse::record('api_call', 'stripe', 250)  // type, key, value
 - Do NOT expose the Pulse dashboard without authentication.
 - Do NOT set sample rate to 1.0 on high-traffic production — use 0.1 or lower.
 - Do NOT forget to run `pulse:check` for server metrics.
-- Do NOT store Pulse data in the main application DB on large apps.
+- Do NOT store Pulse data in the main application database on large apps.

package/dist/agent-src/skills/laravel-reverb/SKILL.md

@@ -29,11 +29,12 @@ and Laravel Echo client setup, see the [laravel-websocket](../laravel-websocket/
 
 ## Procedure: Set up Reverb
 
-1. **Install** — `php artisan install:broadcasting` or manual setup (see below).
-2. **Configure** — Set environment variables for Reverb host, port, app credentials.
-3. **Start server** — `php artisan reverb:start`.
-4. **Connect client** — Configure Laravel Echo with Reverb credentials.
-5. **Verify** — Confirm WebSocket connection in browser console, test event delivery.
+1. **Inspect current broadcasting** — Check `config/broadcasting.php`, `.env`, and `composer.json` for Pusher / Reverb / Soketi presence and current driver.
+2. **Install** — `php artisan install:broadcasting` or manual setup (see below).
+3. **Configure** — Set environment variables for Reverb host, port, app credentials.
+4. **Start server** — `php artisan reverb:start`.
+5. **Connect client** — Configure Laravel Echo with Reverb credentials.
+6. **Verify** — Confirm WebSocket connection in browser console, test event delivery.
 
 Laravel Reverb is Laravel's first-party, blazing-fast WebSocket server. It uses the
 **Pusher protocol**, making it compatible with Laravel Echo and any Pusher-compatible client.

package/dist/agent-src/skills/laravel-scheduling/SKILL.md

@@ -26,6 +26,11 @@ Use this skill when scheduling recurring tasks:
 
 ## Procedure: Create a scheduled task
 
+1. **Inspect existing schedule** — Read `routes/console.php` (Laravel 11+) or `app/Console/Kernel.php` to identify current cadence, overlap-prevention patterns, and output handling.
+2. **Pick frequency and concurrency policy** — Choose a frequency helper (see table) or a cron expression; decide whether `withoutOverlapping()` / `onOneServer()` is required.
+3. **Register the task** — Add the `Schedule::command(...)` / `Schedule::job(...)` entry; wire log destinations and `runInBackground()` if needed.
+4. **Verify** — Run `php artisan schedule:test` (or `schedule:list`) and confirm timing, output path, and overlap behavior.
+
 ### In routes/console.php (Laravel 11+)
 
 ```php
@@ -174,4 +179,4 @@ Schedule::command('reports:weekly')->weeklyOn(1, '07:00');
 - Do NOT add multiple cron entries — use Laravel's scheduler for everything.
 - Do NOT schedule heavy work directly — dispatch a queued job instead.
 - Do NOT forget `withoutOverlapping()` for tasks that may run longer than their interval.
-- Do NOT hardcode times — use environment-based config when schedules vary per env.
+- Do NOT hardcode times — use environment-based config when schedules vary per environment.

package/dist/agent-src/skills/laravel-validation/SKILL.md

@@ -73,6 +73,18 @@ Do NOT use when:
 - Do NOT use `$request->all()` — use `$request->validated()`.
 - Do NOT put business logic in validation classes.
 
+## Verification
+
+Confirm new rules with a concrete probe: a Pest feature test that POSTs with `curl`-shaped payloads through the browser/HTTP client, or a `phpunit`/`pest` run against the FormRequest. Add at least one negative case per rule (missing, wrong type, boundary). Never claim rules work without running them.
+
+## Anti-bruteforce — diagnose before retry
+
+When a rule fires unexpectedly, do not blindly toggle `required` / `nullable` / `sometimes` until tests pass. Print `$request->all()` once, compare against the rule set, identify the root cause, then make a targeted fix.
+
+## Clarification guard — ambiguous field → ask
+
+If a field's intent is unclear (is `tags` a CSV string, an array, or JSON? is `email` required at create or only at update?), ask the user or check the existing schema / API contract before guessing. Hidden assumptions in validation rules surface as production 422s.
+
 ## Auto-trigger keywords
 
 - validation

package/dist/agent-src/skills/launch-readiness/SKILL.md

@@ -78,7 +78,7 @@ report per [`docs/contracts/prelaunch-diagnostics.md`](../../../docs/contracts/p
   (`prelaunch-areas.yml`): auth · migrations · secrets · observability ·
   rollback · agent-governance. No ad-hoc areas.
 - **Every area gets one state:** `pass` (cited evidence REQUIRED) ·
-  `finding` (IDs listed) · `unknown` (honest default — **absence of
+  `finding` (IDs listed) · `unknown` (the honest default — **absence of
   findings is Unknown, never an automatic Pass**) · `not-applicable`
   (reason required).
 - **Findings carry immutable IDs** (`AC-<AREA>-NNN`) — retitle freely,

package/dist/agent-src/skills/learning-to-rule-or-skill/SKILL.md

@@ -68,8 +68,8 @@ Do not use this skill when:
 * One-off or too narrow → do not create anything yet
 * Standard tool knowledge (jq, docker, git basics) → **Nothing** — the model knows this
 * If unsure between skill and guideline: does it need step-by-step decisions? → Skill. Just conventions? → Guideline
-* If unsure between guideline and pattern: prose convention ("how to write code in X")? → Guideline. Keyed recipe ("problem P → recipe + verification + reliability")? → **Pattern**
-* When a related workflow fires, **surface** a matching `src/patterns/` recipe (never auto-apply) — the human decides
+* If unsure between guideline and pattern: is it *"how to write code in X"* (prose convention)? → Guideline. Is it *"I have problem P — here's the proven recipe + a verification step + how reliable it is"*? → **Pattern**
+* When a related workflow fires, **surface** a matching `src/patterns/` recipe (never auto-apply) — the human decides whether to use it
 
 ## Procedure
 
@@ -238,8 +238,8 @@ to stage `gated`.
 If the learning came from an `agents/knowledge/procedures/skill-candidates.md`
 entry or any other `agents/knowledge/` page (see § "Knowledge-candidate
 learnings" below), promotion is **not complete** until the source is
-degraded to a pointer — this prevents double-maintenance between the
-knowledge page and the new artifact:
+degraded to a pointer — this is what prevents double-maintenance between
+the knowledge page and the new artifact:
 
 ```bash
 ./scripts-run src/scripts/degrade_to_pointer \
@@ -249,9 +249,9 @@ knowledge page and the new artifact:
 ```
 
 This rewrites the source entry to `Promoted to <artifact> on <date>; see
-<path>.` and regenerates `agents/knowledge/INDEX.md`. Skip when the
-learning's source was NOT a knowledge page (direct user request,
-audit-log pattern, one-off observation).
+<path>.` and regenerates `agents/knowledge/INDEX.md`. Skip this step
+only when the learning's source was NOT a knowledge page (e.g. a direct
+user request, an audit-log pattern, or a one-off observation).
 
 ## Output format
 

package/dist/agent-src/skills/learning-tutor/SKILL.md

@@ -12,15 +12,15 @@ packs:
 # learning-tutor
 
 > Structured tutoring modes for learning WITH the agent instead of consuming
-> explanations FROM it. Default agent behavior on "teach me X" = prose
+> explanations FROM it. The default agent behavior on "teach me X" is a prose
 > lecture — pedagogically the weakest format. This skill replaces the lecture
-> with six evidence-shaped modes: triage what to learn, practice before
-> theory, withhold answers until the learner has tried, verify understanding
-> with probes the learner cannot bluff through.
+> with six evidence-shaped modes: triage what to learn, practice before theory,
+> withhold answers until the learner has tried, verify understanding with
+> probes the learner cannot bluff through.
 
 ## When to use
 
-Use when the user:
+Use this skill when the user:
 
 - Wants to get functional in a new tool, framework, language or topic fast
   ("teach me X", "get me productive in X", "crash course").
@@ -28,32 +28,32 @@ Use when the user:
   "let me apply it", "give me exercises").
 - Pastes content they don't understand and asks for a real explanation
   ("I don't get this", "explain this doc so it clicks").
-- Has a concrete goal with a deadline, wants a learning plan
-  ("learning plan for X", "need to ship Y in two weeks, don't know Z").
-- Wants existing knowledge stress-tested ("quiz me", "do I actually
+- Has a concrete goal with a deadline and wants a learning plan
+  ("learning plan for X", "I need to ship Y in two weeks and don't know Z").
+- Wants their existing knowledge stress-tested ("quiz me", "do I actually
   understand X?", "find my blind spots").
-- Just learned something, wants to verify it stuck ("check my
+- Just learned something and wants to verify it stuck ("check my
   understanding", "let me explain it back to you").
 
 Do NOT use when:
 
-- User asks a direct factual or how-to question — answer it
+- The user asks a direct factual or how-to question — answer it
   (per `direct-answers`); don't convert a question into a curriculum.
-- User wants the agent to DO the task, not to learn it.
-- "Learning" target is this package's own artifacts (rules/skills) —
+- The user wants the agent to DO the task, not to learn it.
+- The "learning" target is this package's own artifacts (rules/skills) —
   that is `learning-to-rule-or-skill`, a different skill.
-- User wants a plan/idea stress-tested — that is `adversarial-review`
+- The user wants a plan/idea stress-tested — that is `adversarial-review`
   or `/challenge-me`, not knowledge tutoring.
 
 ## Procedure
 
-1. **Select the mode** from user intent (table below). Pick ONE; if two fit,
-   pick the one matching the user's verb ("learn" → teach modes 1–4,
+1. **Select the mode** from the user's intent (table below). Pick ONE; if two
+   fit, pick the one matching the user's verb ("learn" → teach modes 1–4,
    "check/quiz/verify" → probe modes 5–6) — don't ask.
-2. **State the chosen mode** in one line, freeze the target
+2. **State the chosen mode** in one line and freeze the target
    (skill/topic/goal).
 3. **Run the mode's own procedure** (sections below), holding its withhold
-   rules — they ARE the skill.
+   rules — they are the skill.
 4. **Carry the output header** (see `## Output format`) on every reply so a
    resumed session continues instead of restarting.
 5. **Close the session** with the mode's closing analysis and exactly one
@@ -72,16 +72,16 @@ Do NOT use when:
 
 ## Mode 1 — Rapid competence
 
-Frame: one time-boxed session (default 4 focused hours unless user names a
-budget), never met again — every minute must transfer skill. No theory block
-without immediate practical use.
+Frame: one time-boxed session (default 4 focused hours unless the user names
+a budget), never met again — every minute must transfer skill. No theory
+block without an immediate practical use.
 
 1. Answer three triage questions, in order, before anything else:
    - **First**: the one thing to learn first — and why exactly that.
    - **Ignore**: what to skip entirely for now — and why skipping is safe.
    - **Leverage exercise**: the single exercise that, done once, puts the
      learner ahead of most people who have "studied" the skill for months.
-2. Run the session practice-first: each concept introduced only at the
+2. Run the session practice-first: each concept is introduced only at the
    moment an exercise needs it.
 3. Close with the next leverage exercise for the learner's own follow-up.
 
@@ -97,25 +97,26 @@ mistake.
 3. Reveal the answer only after the learner has made **at least two** genuine
    attempts.
 4. Repeat the cycle with variations until the learner applies the concept
-   without hesitation; then say so explicitly, stop.
+   without hesitation; then say so explicitly and stop.
 
 ## Mode 3 — Keystone decoding
 
-Frame: user supplied content (doc, text, code, spec) that doesn't click.
+Frame: the user supplied content (doc, text, code, spec) that doesn't click.
 
 1. Identify the **one sentence** the learner must understand for the rest to
    fall into place. Name it verbatim from the content.
-2. Explain only that sentence first — with an everyday analogy, no technical
-   term left unexplained in the same breath.
-3. Ask exactly **3 comprehension questions** designed so only someone who
-   actually understood can answer (no yes/no, no recall of wording).
+2. Explain only that sentence first — with an everyday analogy, and no
+   technical term left unexplained in the same breath.
+3. Ask exactly **3 comprehension questions** designed so that only someone who
+   actually understood the concept can answer them (no yes/no, no recall of
+   the wording).
 4. Continue into the rest of the content only after all three are answered
-   correctly; on a wrong answer, re-explain from a different angle, re-ask.
+   correctly; on a wrong answer, re-explain from a different angle and re-ask.
 
 ## Mode 4 — Goal-backward sprint
 
-Frame: user has a specific outcome, a time frame, a current level. Plan
-targets the OUTCOME, not the subject in general.
+Frame: the user has a specific outcome, a time frame and a current level. The
+plan targets the OUTCOME, not the subject in general.
 
 1. Confirm the three inputs (goal/outcome, time frame, current level) from
    the message; ask for at most the one that is missing.
@@ -124,12 +125,12 @@ targets the OUTCOME, not the subject in general.
    - **One task**, completable in ~45 minutes.
    - **One success criterion** — how the learner verifies they did it right.
    - **One exclusion rule** — what they deliberately do NOT touch that day.
-3. Self-check the path against the goal: a day that doesn't causally move the
-   learner toward the stated outcome → rework before presenting.
+3. Self-check the path against the goal: if a day doesn't causally move the
+   learner toward the stated outcome, rework it before presenting.
 
 ## Mode 5 — Gap probe
 
-Frame: user believes they already know the subject. Job: prove otherwise.
+Frame: the user believes they already know the subject. Job: prove otherwise.
 
 1. Ask **5 questions** that look deceptively simple but expose the classic
    gaps of someone who never went deep — edge cases, "why" behind defaults,
@@ -142,8 +143,8 @@ Frame: user believes they already know the subject. Job: prove otherwise.
 
 ## Mode 6 — Feynman check
 
-Frame: user explains the freshly learned topic as if the agent were a
-10-year-old. Agent listens and interrupts.
+Frame: the user explains the freshly learned topic as if the agent were a
+10-year-old. The agent listens and interrupts.
 
 1. Invite the explanation; interrupt immediately when the learner:
    - uses a technical term without being able to say what it means,
@@ -151,7 +152,7 @@ Frame: user explains the freshly learned topic as if the agent were a
    - oversimplifies to the point of being factually wrong.
 2. Each interruption is one pointed question, not a correction.
 3. Close with a precise analysis: what the accumulated stumbles reveal about
-   which parts of the understanding are not yet solid — and which held.
+   which parts of the understanding are not yet solid — and which parts held.
 
 ## Output format
 
@@ -167,7 +168,7 @@ Next:     <what the learner does next>
 
 Required fields (ordered):
 
-1. **Mode line** — mode number + name, stated in the first reply, kept on
+1. **Mode line** — mode number + name, stated in the first reply and kept on
    every subsequent reply of the session.
 2. **Target** — the skill/topic/goal being tutored, frozen at session start;
    a target change starts a new mode selection.
@@ -180,14 +181,14 @@ Required fields (ordered):
 
 - **Lecture relapse** — after 2–3 turns the agent drifts back into
   explaining instead of asking. The withhold rules (mode 2: answer only
-  after 2 attempts; mode 3: proceed only after 3/3 correct) ARE the skill;
+  after 2 attempts; mode 3: proceed only after 3/3 correct) are the skill;
   dropping them silently turns every mode back into mode zero.
-- **Solving instead of tutoring** — learner pastes their broken attempt,
-  agent fixes it. In modes 2/5/6 the fix is withheld; the question comes
-  first. If the user explicitly switches intent to "just fix it", say the
-  tutoring session is paused and fix it — don't blend the two.
+- **Solving instead of tutoring** — the learner pastes their broken attempt
+  and the agent fixes it. In modes 2/5/6 the fix is withheld; the question
+  comes first. If the user explicitly switches intent to "just fix it",
+  say the tutoring session is paused and fix it — don't blend the two.
 - **Flattery corrupts the probe** — modes 5 and 6 only work blunt. "Great
-  answer!" on a shallow answer defeats the mode (`direct-answers`
+  answer!" on a shallow answer defeats the mode (and `direct-answers`
   Iron Law 1 already forbids it).
 - **Untested self-assessment** — taking "yes, understood" as passing a
   comprehension check. Only a correct answer to a probe question counts;

package/dist/agent-src/skills/learning-tutor/evals/triggers.json

@@ -0,0 +1,52 @@
+{
+    "skill": "learning-tutor",
+    "last_eval": "2026-07-30",
+    "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers DE + EN phrasings for the six tutoring modes — rapid competence, error-driven drill, keystone decoding, goal-backward sprint, gap probe, Feynman check. Should-not-trigger covers the near-miss neighbours (package-artifact learning capture, plan stress-testing, long-form article analysis, employee onboarding programs, plain factual how-to answers) whose vocabulary overlaps.",
+    "queries": [
+        {
+            "q": "teach me Postgres query planning — get me functional fast, practice first",
+            "trigger": true
+        },
+        {
+            "q": "quiz me on database indexes and find my blind spots, don't go easy on me",
+            "trigger": true
+        },
+        {
+            "q": "I don't get this spec — explain it so it actually clicks and then check I understood",
+            "trigger": true
+        },
+        {
+            "q": "bring mir Kubernetes bei und drill mich, statt mir einen Vortrag zu halten",
+            "trigger": true
+        },
+        {
+            "q": "I have to ship a Terraform module in two weeks and I've never used it — give me a learning plan",
+            "trigger": true
+        },
+        {
+            "q": "I keep making this same mistake — turn that learning into a rule for the package",
+            "trigger": false,
+            "note": "capturing a learning as a package artifact (agent learns, not the user) → learning-to-rule-or-skill"
+        },
+        {
+            "q": "poke holes in this migration plan, be brutal",
+            "trigger": false,
+            "note": "stress-testing a plan/artifact, not a person's understanding → adversarial-review"
+        },
+        {
+            "q": "deep-dive this article and extract the insights with mental models",
+            "trigger": false,
+            "note": "long-form content analysis for the reader, no tutoring modes or comprehension gates → deep-reading-analyst"
+        },
+        {
+            "q": "design our onboarding so new hires ramp faster, with 30/60/90 milestones",
+            "trigger": false,
+            "note": "employee onboarding program design, not tutoring a topic → onboarding-program"
+        },
+        {
+            "q": "what's the difference between a left join and an inner join?",
+            "trigger": false,
+            "note": "direct factual question — answer it, never convert it into a curriculum (per direct-answers); the skill explicitly excludes this"
+        }
+    ]
+}

package/dist/agent-src/skills/license-compliance-audit/SKILL.md

@@ -15,10 +15,10 @@ Gate G0 (`road-to-provenance-and-license-governance`, Phase 0) measured both
 candidate similarity detectors against a frozen golden corpus and neither
 met the pre-registered bar for a CI gate. Council resolved (2026-07-28,
 Option A): **no `lint_code_provenance.ts` in any form — not even
-advisory.** This skill is the result: the scan capability that used to be a
-planned CI gate now exists only as something a human invokes deliberately,
-so every hit gets investigated *because* a human asked for it — never as a
-silent pipeline signal nobody reads.
+advisory.** This skill is the result of that decision: the scan capability
+that used to be a planned CI gate now exists only as something a human
+invokes deliberately, so every hit gets investigated *because* a human
+asked for it — never as a silent pipeline signal nobody reads.
 
 ## When to use
 
@@ -47,13 +47,13 @@ Do NOT use when:
    ```bash
    npx jscpd --version
    ```
-   The online layer (L0) is optional — check whether it's installed and
+   The online layer (L0) is optional — check whether it is installed and
    reachable:
    ```bash
    scanoss-py --version   # or: pip show scanoss
    ```
-   Offline-only is expected and fine in most environments — report it
-   honestly, not as a failure.
+   Offline-only is expected and fine in most environments; report it
+   honestly rather than treating it as a failure.
 2. **Run the offline scan (L-1)** against the target path or diff:
    ```bash
    npx jscpd <path> --min-tokens 25

package/dist/agent-src/skills/license-compliance-borrow-check/SKILL.md

@@ -56,7 +56,7 @@ that rule. Run both checks; treat neither as a substitute for the other.
    npx tsx node_modules/@event4u/agent-config/src/scripts/detect_target_license.ts . --json
    ```
    If `license-policy.yaml` exists at the repo root, read its
-   `policy.{allow,conditional,deny}` buckets directly. If it doesn't (dry
+   `policy.{allow,conditional,deny}` buckets directly. If it does not (dry
    run only), derive the same buckets by hand from this repo's own
    `LICENSE` file and the compatibility matrix in
    `node_modules/@event4u/agent-config/src/scripts/_lib/detect_target_license.ts`
@@ -68,7 +68,7 @@ that rule. Run both checks; treat neither as a substitute for the other.
    `unknown` is **always** `deny` — no exception.
 5. **Act on the verdict:**
    - `allow` → continue to step 6 (draft the ledger entry).
-   - `conditional` → STOP. Don't write the borrowed code yet. Escalate to
+   - `conditional` → STOP. Do not write the borrowed code yet. Escalate to
      the user with the exact matrix cell that triggered it (per
      [`ask-when-uncertain`](../../rules/ask-when-uncertain.md)) — never
      auto-clear a conditional verdict.
@@ -81,7 +81,7 @@ that rule. Run both checks; treat neither as a substitute for the other.
    `cleared_by`). Write a `transformation_note` that names a real
    structural change — rename-only phrasing (e.g. "renamed variables",
    "cosmetic rename") is rejected by `lint_provenance.ts` even if the code
-   hasn't landed yet, so draft it honestly against what will actually
+   has not landed yet, so draft it honestly against what will actually
    change.
 7. **Present the draft to the user before appending it.** Once the
    re-derived code lands, append the confirmed entry to

package/dist/agent-src/skills/license-compliance-credits/SKILL.md

@@ -34,16 +34,16 @@ Do NOT use when:
 
 ## Procedure
 
-1. **Inspect the current state** — read `provenance/borrows.jsonl` (may be
-   legitimately empty) and note its line count before regenerating, so the
-   diff is checkable.
+1. **Inspect the current state** — read `provenance/borrows.jsonl` (it may
+   be legitimately empty) and note how many lines it has before
+   regenerating, so the diff is checkable.
 2. **Regenerate the notices file:**
    ```bash
    npx tsx node_modules/@event4u/agent-config/src/scripts/lint_provenance.ts --regenerate-notices
    ```
 3. **Diff `docs/THIRD-PARTY-NOTICES.md`** before vs. after — confirm only
    that generated file changed, and that `provenance/borrows.jsonl` itself
-   was not touched (it's append-only; this command never writes to it).
+   was not touched (it is append-only; this command never writes to it).
 4. **Verify sync + validity** with a plain run (no flag):
    ```bash
    npx tsx node_modules/@event4u/agent-config/src/scripts/lint_provenance.ts

package/dist/agent-src/skills/llm-provider-knowledge/SKILL.md

@@ -2,7 +2,6 @@
 model_tier: inherit
 name: llm-provider-knowledge
 description: "Before stating any specific fact about an LLM provider's product — models, pricing, limits, context windows, SDK/API — for OpenAI, Gemini, Claude & others, verify against official docs, not memory."
-source: package
 domain: process
 personas: []
 workspaces: