@event4u/agent-config 9.9.0 → 9.11.0

package/dist/agent-src/skills/memory-consolidation/SKILL.md

@@ -21,8 +21,11 @@ packs:
 - Before closing out a multi-day implementation, capture project-scoped facts so the next agent does not re-discover them.
 
 Do NOT use for one-off code review notes (those belong in PR comments,
-not memory), for user-attribute facts like name or IDE preference (the
-`onboard` flow owns those), or for transient TODOs (use the task list).
+not memory), or for transient TODOs (use the task list). User-attribute
+facts like name, language, or IDE preference route to the global
+user-scoped channel (§ Global user-scoped channel, below) — never into
+`agents/memory/` curated YAML — and land via `/agents:user review` /
+`/agents:user accept`, not `/memory:promote`.
 
 ## Cognition cluster
 
@@ -48,7 +51,10 @@ not advance until the gate is green.
 2. Inspect the current curated state: list files under
    `agents/memory/` and check the most recent `last_validated`
    timestamps. Identify which schemas are stale before mining adds
-   noise.
+   noise. **Also resolve `detect_managed_agents_folder(projectRoot)`**
+   once here — CONSOLIDATE step 2 needs the answer to know whether
+   project-scoped facts land in `agents/memory/intake/` or route through
+   the global buffer instead (§ Project attribution channel, below).
 3. Review the **repo** slot of the [context-spine](../../../docs/contracts/context-spine.md)
    for project boundaries (modules, owners, sensitive paths). If empty,
    note the gap in the consolidation report; do not invent.
@@ -71,12 +77,35 @@ missing, stop.
    pronouns, IDE chrome, timestamps, and turn-id. The fact must be
    project-scoped (refers to a file, module, command, or invariant)
    not user-scoped (refers to *me*, *Matze*, *my IDE*).
-3. Drop user-attribute matches. If the fact cannot survive the
-   normalisation, discard it. The miner is a strict gate.
-
-**Exit gate:** ≤ 5 normalised facts per cycle. More than 5 means the
-miner is too loose; tighten patterns and re-run before promoting.
-
+3. **Route user-attribute matches to the global user-scoped channel**
+   (§ below) instead of discarding them — a Preference-family match that
+   fails the project-scoped check is about the user, not the project, and
+   as of road-to-global-user-memory Phase 2 it has a destination. Only a
+   fact that survives neither the project-scoped normalisation NOR the
+   user-scoped shaping (§ below) is dropped. The miner is still a strict
+   gate — a fact with nowhere to land does not get invented a home.
+
+**Exit gate:** ≤ 5 normalised facts per cycle, **counted across both
+channels together** (curated-project facts + global-buffer candidates —
+see § Global user-scoped channel). More than 5 combined means the miner is
+too loose; tighten patterns and re-run before promoting.
+
+### The two user-memory channels (road-to-global-user-memory Phases 2-3)
+
+GATHER SIGNAL feeds two write paths besides the project intake. Both are
+governed by capture-time guards and a human accept; neither may write
+`profile.md` directly.
+
+- **Global user-scoped channel** — the Preference family already matches text
+  about the USER, not the project. Instead of discarding those matches, shape
+  them as observations into the global buffer.
+- **Project attribution channel** — a project-scoped fact whose project has no
+  managed `agents/` folder routes through the three-state predicate; recurrence
+  is tallied and surfaces as a promotion CANDIDATE, never an automatic promotion.
+
+Mechanics, guard classes, the shared ≤5 cap and the router table:
+[`user-memory-channels`](../../agent-src/contexts/execution/user-memory-channels.md).
+Read it before touching either path — the guards are restated there, not linked.
 ### Phase 3 — CONSOLIDATE
 
 1. Tag each fact via the schema-routing table:
@@ -93,7 +122,8 @@ miner is too loose; tighten patterns and re-run before promoting.
    [`memory-access`](../../../docs/guidelines/agent-infra/memory-access.md)
    for the file-backed retrieval contract over the curated YAML.
 
-2. Append each fact as one JSONL line to
+2. **Managed project only** (§ Project attribution channel, above, for the
+   unmanaged case). Append each fact as one JSONL line to
    `agents/memory/intake/<primary-tag>.jsonl` with required fields
    per the contract: `ts`, `type`, `key`, `observation`, `source:
    agent`, `session_id`, plus the new optional `tags: [<one>, <two>]`.
@@ -162,10 +192,10 @@ skills — github.com/ViktorAxelsen/MemSkill, Apache-2.0, commit `9907c35f8cc7`)
 - **Threshold-tiered dedup decision** (enforced by `check_memory_similarity.ts`
   / `_lib/text_similarity.ts` — reuse its `MERGE_THRESHOLD` / `WARN_THRESHOLD`
   consts, never hardcode): similarity **≥ 0.80 → merge** into the existing
-  entry; **0.40–0.80 → read and judge**, merge as default; **< 0.40 → create**.
-  Cap new-entry creation per consolidation cycle. Rationale: over-merging is
-  cheap to undo; over-creating silently poisons downstream retrieval, so the
-  tie-break leans to merge.
+  entry; **0.40–0.80 → read and judge**, with merge as the default; **< 0.40 →
+  create**. Cap new-entry creation per consolidation cycle. Rationale:
+  over-merging is cheap to undo; over-creating silently poisons downstream
+  retrieval, so the tie-break leans to merge.
 - **Merge on refresh, preserve what still holds.** When a fact updates an
   existing entry, merge into one item and keep the details that remain true.
 - **Fact-change: invalidate-old-then-add-new, never silent overwrite.** When a
@@ -280,42 +310,6 @@ work ("that bug", "the migration"), and past-time cues ("last week",
 "back then"). These phrasings imply the user expects continuity with
 something already known, not a first-time explanation.
 
-## TranscriptAdapter contract
-
-The miner is host-agnostic by design. A `TranscriptAdapter` for host
-`X` ships:
-
-- **Discover:** function returning the absolute path(s) of session
-  transcripts for the active project, scoped to the `--since` window.
-  Phase 1 ships the Claude-Code adapter only; absent adapter →
-  `not-supported-on-this-host`.
-- **Iterate:** generator yielding turn objects with `{role, ts,
-  text}`. Adapter strips IDE chrome and tool-call boilerplate before
-  yielding.
-- **Redact:** function applied to every yielded text — drops user
-  names, file paths outside the repo root, and any personal
-  identifier the consumer project lists in
-  `.agent-settings.yml` under `memory.redact_patterns`.
-
-The GATHER implementation lives in the single mining command
-`/memory:mine-session` (`scripts/mine_session.ts`). It reads the
-**cross-host** chat-history JSONL log (`agents/runtime/.agent-chat-history`,
-written by platform hooks on every host), falling back to the per-host
-Claude-Code transcript when the log is absent. `--mode=[signals|proposals|both]`
-selects intake signals and/or rule/skill proposal seeds — the latter folds in
-the former `/chat-history learn`.
-
-## In-task notes → cross-run lessons (RDP)
-
-The Reasoning Discipline Protocol writes an **in-task** session-notes file
-(hypotheses, killed beliefs, predictions, decisions, uncertainty — structure in
-[`notes-first-reasoning`](../../rules/notes-first-reasoning.md)). That file is
-ephemeral working state, not curated memory. This skill is the **promotion path**:
-when an in-task killed-belief, calibrated prediction, or decision *generalises*
-beyond the task, consolidate it here as a durable cross-run lesson (one lesson per
-file, with why it mattered). Apply the same signal-vs-noise discipline — most
-in-task notes stay in-task and are discarded with the task.
-
 ## Related Skills
 
 **WHEN to use this**
@@ -327,8 +321,10 @@ in-task notes stay in-task and are discarded with the task.
 **WHEN NOT to use this**
 
 - One-off PR review notes — comment on the PR.
-- User-attribute facts (name, IDE) — those belong to the
-  [`onboard`](../../commands/onboard.md) flow, not curated memory.
+- User-attribute facts (name, language, IDE preference) — those route to
+  the global user-scoped channel (§ Global user-scoped channel) and land
+  via `/agents:user review` / `/agents:user accept`, never into curated
+  project memory.
 - Transient TODOs — use the task-list tools.
 - A single bug fix that does not generalise — fix the bug, do not
   memorise it.
@@ -367,6 +363,10 @@ in-task notes stay in-task and are discarded with the task.
   `yesterday|today|tomorrow|last/next/this week|month|year` in curated
   YAML without an `YYYY-MM-DD` anchor within ±20 chars. Re-anchor
   before commit.
+- `seen_count` only bumps when the SAME observation recurs in a
+  DIFFERENT project — re-mining the same unmanaged project twice does
+  not grow the counter, so three sessions in one repo will never reach
+  the promotion threshold on their own.
 
 ## Do NOT
 
@@ -378,18 +378,23 @@ in-task notes stay in-task and are discarded with the task.
   repo root or names another consumer project.
 - Do NOT delete a stale curated entry without explicit user
   confirmation. Stale-flag is the most this skill emits.
+- Do NOT write a user-scoped observation into `agents/memory/` curated
+  YAML or its intake JSONL — route it to the global observation buffer
+  (§ Global user-scoped channel) instead.
+- Do NOT let the global user-scoped channel bypass a capture-time guard
+  "just this once" — a candidate that trips `standing_command`,
+  `self_harmful_preference`, `exclusion_list`, or `hidden_unicode` is
+  refused outright, never redacted-then-stored.
+- Do NOT write a project-scoped fact to `agents/memory/intake/` in an
+  `unmanaged` or `not-a-project` repo — route it through
+  `routeProjectObservation` instead (§ Project attribution channel).
+  Writing to `agents/memory/intake/` there either fails or scaffolds an
+  unmanaged `agents/` directory as an unintended side effect.
+- Do NOT treat a `seen_count ≥ 3` observation as promoted. Crossing the
+  threshold only makes it a candidate `/agents:user review` surfaces —
+  `/agents:user accept` still requires an explicit human `promotion_reason`
+  before anything reaches `profile.md`.
 
 ## Runnable example
 
-After a 4-day refactor of `app/Services/PaymentGateway`, run a
-consolidation cycle:
-
-- `/memory:mine-session --since 2026-05-06 --confirm-transcript-access --preview`.
-- Miner surfaces 4 facts: 1 correction (`PaymentGateway::charge` must
-  not throw on idempotency replays — `convention`), 1 decision
-  (Laravel example: `Stripe webhook signing key lives in `config/services.php` only —
-  `gotcha`), 2 patterns (`PaymentGatewayTest` flakes when seeded data
-  carries timestamps in microseconds — `pattern + gotcha`).
-- Report cites 0 stale flags. Re-run with `--commit-intake` after
-  spot-checking the 4 facts.
-- Hand off to `/memory:promote` for the curated-YAML write.
+See [`user-memory-channels`](../../agent-src/contexts/execution/user-memory-channels.md) § Runnable example — moved there with the channel mechanics it exercises.

package/dist/agent-src/skills/motion-choreographer/SKILL.md

@@ -186,12 +186,12 @@ stdin shape. The orchestrator pipes this into the video adapter's
 
 ## Policies
 
-Motion prompts inherit upstream blueprint constraints. Before emitting provider-tuned prose:
+Motion prompts inherit every constraint the upstream blueprint carries. Before emitting provider-tuned prose:
 
-- [`agents/settings/policies/media/disclosure.md`](../../../agents/settings/policies/media/disclosure.md) — every distributed clip → non-removable AI-generation disclosure; refuse adapter flags that suppress it.
-- [`agents/settings/policies/media/transparency.md`](../../../agents/settings/policies/media/transparency.md) — provider provenance (C2PA / SynthID) preserved; refuse re-encode flags that strip provenance.
-- [`agents/settings/policies/media/voice-cloning.md`](../../../agents/settings/policies/media/voice-cloning.md) — motion prompt requests `audio: native` in named voice.
-- [`agents/settings/policies/media/brand-impersonation.md`](../../../agents/settings/policies/media/brand-impersonation.md) — copies recognised brand's chyron / mascot / signature transition.
+- [`agents/settings/policies/media/disclosure.md`](../../../agents/settings/policies/media/disclosure.md) — every distributed clip carries the non-removable AI-generation disclosure; refuse adapter flags that would suppress it.
+- [`agents/settings/policies/media/transparency.md`](../../../agents/settings/policies/media/transparency.md) — provider provenance (C2PA / SynthID) is preserved; refuse re-encode flags whose effect is to strip provenance.
+- [`agents/settings/policies/media/voice-cloning.md`](../../../agents/settings/policies/media/voice-cloning.md) — when the motion prompt requests `audio: native` narration in a named voice.
+- [`agents/settings/policies/media/brand-impersonation.md`](../../../agents/settings/policies/media/brand-impersonation.md) — when the motion prompt copies a recognised brand's chyron / mascot / signature transition.
 
-Refuse-and-surface; motion prompt cannot launder upstream policy gap.
+Refuse-and-surface; the motion prompt cannot launder a policy gap upstream skills should have caught.
 

package/dist/agent-src/skills/pdf-tools/evals/triggers.json

@@ -0,0 +1,52 @@
+{
+    "skill": "pdf-tools",
+    "last_eval": "2026-07-30",
+    "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers DE + EN phrasings for PDF write/transform work the skill owns — merge / split / rotate / encrypt, AcroForm fill + flatten decision, create-from-content, structured text/table extraction and OCR of a text-layer-less scan. Should-not-trigger covers the near-miss neighbours (PDF→Markdown ingestion, image OCR, Word authoring, spreadsheet authoring, legal document triage) whose vocabulary overlaps.",
+    "queries": [
+        {
+            "q": "merge these three PDFs into one file and drop the duplicate cover page",
+            "trigger": true
+        },
+        {
+            "q": "fill this AcroForm PDF with the applicant values, then flatten it so it ships as final",
+            "trigger": true
+        },
+        {
+            "q": "split the PDF into one file per page and rotate the landscape ones",
+            "trigger": true
+        },
+        {
+            "q": "erstelle aus diesem Inhalt ein PDF und verschlüssele es mit einem Passwort",
+            "trigger": true
+        },
+        {
+            "q": "extract the tables from this PDF — OCR the pages if there is no text layer",
+            "trigger": true
+        },
+        {
+            "q": "convert this PDF to Markdown so I can read it in the repo",
+            "trigger": false,
+            "note": "PDF → Markdown ingestion, not a PDF write/transform → markitdown"
+        },
+        {
+            "q": "OCR this screenshot into text for me",
+            "trigger": false,
+            "note": "OCR of a standalone image, not of a scanned PDF's rasterized pages → markitdown"
+        },
+        {
+            "q": "generate a Word document from this template and fill in the placeholders",
+            "trigger": false,
+            "note": "Word .docx authoring / template fill → docx-authoring"
+        },
+        {
+            "q": "build me a spreadsheet model from these numbers with formulas instead of hardcoded values",
+            "trigger": false,
+            "note": "spreadsheet / model authoring → spreadsheet-authoring"
+        },
+        {
+            "q": "review this NDA PDF and flag the risky clauses",
+            "trigger": false,
+            "note": "the PDF is only the container; the ask is legal clause triage → nda-triage"
+        }
+    ]
+}

package/dist/agent-src/skills/performance-analysis/SKILL.md

@@ -87,10 +87,14 @@ Focus on code paths with high execution frequency or large data volumes:
 - Missing CDN for static assets
 - Missing response caching for read-heavy endpoints
 - Database connection pooling and limits
-- Queue worker concurrency vs DB connection limits
+- Queue worker concurrency vs database connection limits
 
 ## Output format
 
+1. Emit one entry per bottleneck using the field list below; never collapse multiple bottlenecks into a single entry.
+2. Severity, Effort, and Confidence are required for every entry and must use the bounded vocabulary (Low / Medium / High / Critical for severity).
+3. Close with a *Recommended Fix Order* ranked by `Impact ÷ Effort` and capped at 5 items.
+
 For each bottleneck:
 
 - **Issue:** concise title
@@ -108,12 +112,12 @@ For each bottleneck:
 - **performance** — complementary: performance is about writing fast code, this is about finding slow code
 - **test-performance** — for test suite speed specifically
 - **bug-analyzer** — some performance issues are actually bugs (N+1, infinite loops)
-- **DB** — for deep DB optimization guidance
+- **database** — for deep DB optimization guidance
 
 ## Gotcha
 
 - Don't present raw numbers without context — "200ms" means nothing without knowing the baseline.
-- The model tends to focus on code-level optimization when the bottleneck is a DB query.
+- The model tends to focus on code-level optimization when the bottleneck is a database query.
 - Profiling in development differs from production — different data volumes, different query plans.
 
 ## Do NOT

package/dist/agent-src/skills/persona-improvement/SKILL.md

@@ -11,8 +11,6 @@ workspaces:
   - agent-config-maintainer
 packs:
   - meta
-requires_skills:
-  - persona-governance
 ---
 
 # persona-improvement

package/dist/agent-src/skills/persona-improvement/evals/triggers.json

@@ -0,0 +1,52 @@
+{
+    "skill": "persona-improvement",
+    "last_eval": "2026-07-30",
+    "description": "5 should-trigger + 5 should-not-trigger queries. Should-trigger covers DE + EN phrasings for an explicit request to refine an EXISTING persona's Unique Questions from a correction sample (≥ 3 misses the lens should have caught). Should-not-trigger covers the near-miss neighbours (new-persona authoring, the governance rule, the skill-side improvement pipeline, skill description tuning, persona scope changes) whose vocabulary overlaps.",
+    "queries": [
+        {
+            "q": "improve this persona — its review lens keeps missing the same class of bug",
+            "trigger": true
+        },
+        {
+            "q": "refine the reviewer persona's Unique Questions from the last few review misses",
+            "trigger": true
+        },
+        {
+            "q": "schärfe die Unique Questions dieser Persona anhand der letzten Korrekturen nach",
+            "trigger": true
+        },
+        {
+            "q": "the security persona missed tenant scoping three times now — tighten its questions so it fires next time",
+            "trigger": true
+        },
+        {
+            "q": "here are four corrections the architecture lens should have surfaced; sharpen that lens against them",
+            "trigger": true
+        },
+        {
+            "q": "create a new persona for a database reviewer voice",
+            "trigger": false,
+            "note": "authoring a NEW persona file (voice / focus / output expectations), not refining an existing lens → persona-writing"
+        },
+        {
+            "q": "can I add a third specialist persona to this domain, or do I have to deprecate one?",
+            "trigger": false,
+            "note": "per-domain cap / citation floor / deprecation path question → persona-governance (rule)"
+        },
+        {
+            "q": "the persona should now also cover frontend performance, widen its scope",
+            "trigger": false,
+            "note": "identity / scope change is a new-id change, explicitly out of this loop's scope → persona-governance (rule)"
+        },
+        {
+            "q": "run the skill improvement pipeline now that we captured that learning",
+            "trigger": false,
+            "note": "skill-side capture → classify → create → validate → apply loop, not the persona analog → skill-improvement-pipeline"
+        },
+        {
+            "q": "this skill's description is too vague, rewrite it so it triggers reliably",
+            "trigger": false,
+            "note": "SKILL.md description / trigger tuning, not a persona's Unique Questions → description-assist (authoring rules in skill-writing)"
+        }
+    ]
+}

package/dist/agent-src/skills/php-coder/SKILL.md

@@ -90,6 +90,12 @@ test for a given discriminator, do not re-ask on the next branch.
 1. Code following project guidelines and existing patterns
 2. All downstream changes (callers, tests, imports) included
 
+## Verification examples
+
+- **Backend changes (service, controller, repository)**: probe the route with `curl` or an `actingAs()` HTTP test under `api/`; assert response shape and side effects.
+- **Frontend-adjacent changes (Blade / Livewire component wiring)**: drive the component with a `livewire test`, a Playwright spec, or a browser `screenshot` snapshot.
+- Always run the targeted test (`pest --filter=…`) and the relevant `phpstan` / `rector` checks before claiming done.
+
 ## Gotcha
 
 - Don't introduce new patterns without being asked.
@@ -103,6 +109,10 @@ test for a given discriminator, do not re-ask on the next branch.
 - Do NOT refactor code you're not actively working on.
 - Do NOT use `var_dump()`, `print_r()`, `dd()` — disallowed by PHPStan.
 
+## Anti-bruteforce — diagnose before retry
+
+When PHPStan, Rector, or a test goes red after a change, do not retry blindly by toggling type hints, adding `@phpstan-ignore`, or shuffling arguments until it passes. Diagnose the root cause first — read the error, trace the symbol, then apply a targeted fix. Trial-and-error type narrowing hides real type errors.
+
 ## Auto-trigger keywords
 
 - PHP coding