@event4u/agent-config 9.9.0 → 9.11.0

package/src/config/ci-local-parity.yml

@@ -0,0 +1,142 @@
+# CI ↔ local parity manifest — the input to `check_ci_local_parity.ts`.
+#
+# WHY THIS EXISTS
+# ---------------
+# The local aggregate (`task ci`) and the CI workflows drifted apart in BOTH
+# directions, and each direction cost real defects:
+#
+#   CI-only  — a gate CI runs that no local chain reaches. The contributor pushes,
+#              CI goes red, and the fix costs a round trip. Measured 2026-07-30:
+#              check_portability and check_adr_frontmatter turned a PR red that a
+#              local run would have caught, twice in one session.
+#
+#   local-only — a gate `task ci` runs that no workflow does. Nothing enforces it
+#              remotely, so a defect merges. Measured: check-index had verified the
+#              artefact index for a long time and ran in no workflow, which is how
+#              16 stale rows in agents/index.md + docs/catalog.md reached main.
+#              check_bridge_derivation is the same shape.
+#
+# A gate that exists on one side only drifts silently on the other. This manifest
+# plus the checker makes each direction a declared, reviewable choice instead of an
+# accident.
+#
+# THE CONTRACT
+# ------------
+# The checker DERIVES both sides — it never trusts a hand-maintained list of gates:
+#
+#   CI side     parsed from .github/workflows/*.yml — every `./scripts-run
+#               src/scripts/<name>`, `npx tsx src/scripts/<name>`, `node <path>` and
+#               `task <name>` invocation.
+#   local side  the transitive closure of the `task ci` / `task consistency` chains
+#               plus the pre-push hook, resolved through taskfiles/*.yml.
+#
+# Anything present on one side and absent on the other must appear below with a
+# reason, or the checker fails. That is the whole mechanism: drift is allowed, but
+# only on the record.
+#
+# Parity is by gate ID, not by argv. Three gates run locally in a cheap variant and
+# in CI in a strict one (check_release_published bare vs --strict --check-npm,
+# build_cloud_bundle --check vs --all --clean, build_linear_digest offline vs live).
+# They need no declaration: the parity question is "can a contributor run this before
+# pushing at all", and the answer is yes. Declaring them anyway produced exactly the
+# dead exemption the stale-declaration check exists to catch — it was removed rather
+# than kept, because an exemption nothing needs is one the next reader trusts.
+#
+# WHY NOT JUST "RUN task ci BEFORE EVERY PUSH"
+# --------------------------------------------
+# Because a pre-push gate that is red for a reason the contributor did not cause
+# either blocks every push or trains people to ignore it, and the second is worse
+# than no gate. Two measured bounds from the same sweep:
+#
+#   bucket A (repo-content gates) sum to ~14.5s  → affordable before a push
+#   check_enforcement_coverage alone is 30.7s    → belongs in the post-CI loop
+#
+# So `pre_push_budget_seconds` below is a real budget, not a wish. A gate declared
+# `local_only` or `both` that exceeds it is reported, not silently added to the hook.
+
+# Wall-clock ceiling for the pre-push gate set, in seconds. Derived from the
+# measured bucket-A sum (14.5s) plus headroom; the existing hook already costs
+# `task consistency` + eslint + tsc, so this is a bounded increase, not a new tax.
+pre_push_budget_seconds: 25
+
+# Gates CI runs that no local chain reaches — each needs a reason it cannot or
+# should not run locally. `reason` is free text; `class` is one of:
+#   network        needs a token, a registry, or a live API
+#   release        verifies tag / release / published-package state
+#   artifact       needs something only CI builds (site, tarball, bundle)
+#   benchmark      it is a measurement, timing-sensitive or paid
+#   matrix         needs an OS or Node version this machine is not
+ci_only:
+  - id: adoption_snapshot
+    class: network
+    reason: "live api.npmjs.org + api.github.com calls, reads GITHUB_TOKEN"
+  - id: sync_github_metadata
+    class: network
+    reason: "hard-fails without GITHUB_TOKEN; mutates repo topics/description via the API"
+  - id: check_release_pr_shape
+    class: release
+    reason: "shells out to `gh pr diff <n>` — needs a live PR and a token"
+  - id: check_release_adjacent_health
+    class: release
+    reason: "queries GitHub Actions run history via gh"
+  - id: bench_drift_check
+    class: benchmark
+    reason: "consumes rolling bench reports that only a bench run produces"
+  - id: bench_baseline_ready
+    class: benchmark
+    reason: "same — no local baseline to compare against"
+  - id: bench_hook_latency
+    class: benchmark
+    reason: "a latency measurement; 24.0s measured and timing-sensitive on a loaded machine"
+  - id: check_site_links
+    class: artifact
+    reason: "needs the built Starlight site; exits 2 unbuilt or stale (registered in gate-coverage.yml with unavailable_exit: 2)"
+  - id: pack_mcp_content
+    class: artifact
+    reason: "writes the tracked internal/workers/mcp/content.json deploy artifact — a local run dirties the tree"
+  - id: consumer_matrix
+    class: matrix
+    reason: "consumes the npm pack tarball across a Node version matrix"
+  - id: cross_model_smoke
+    class: network
+    reason: "paid cross-model canary calls, secret-gated"
+  - id: trigger_eval_rotation
+    class: network
+    reason: "paid model calls"
+  - id: self_review_gate
+    class: network
+    reason: "--dry-run in the PR job; the live variant is a paid model call on the PR diff"
+  - id: bench_run
+    class: benchmark
+    reason: "paid model calls against a corpus"
+  - id: bench_runner
+    class: benchmark
+    reason: "the runner behind bench_run — same paid calls"
+  - id: skill_trigger_eval
+    class: benchmark
+    reason: "paid cross-model trigger-activation eval; the offline structural half is check_trigger_evals, which IS local"
+  - id: evaluator_umbrella
+    class: artifact
+    reason: "shell umbrella over CI-only evaluator fixtures"
+  - id: smoke_host_loadability
+    class: artifact
+    reason: "temp-HOME install + `claude plugin validate`; measured >100s, did not finish inside a 2-minute budget"
+  - id: install
+    class: matrix
+    reason: "the installer end-to-end against a scratch HOME on the OS matrix; a local run would rewrite this machine's own agent config"
+  - id: release
+    class: release
+    reason: "tags, bumps, publishes, opens the release PR — the release itself"
+
+# Gates a local chain runs that no workflow does — each needs a reason it is not
+# worth remote enforcement, OR it should simply be added to a workflow. Prefer
+# adding it: a local-only gate is the direction that let real defects merge.
+local_only:
+  - id: check_knowledge_sharing
+    class: staging-scoped
+    reason: >
+      Inspects the STAGED set (a gitignored intake file staged anyway via `git add -f`),
+      and CI has no staged set — the commit already happened by the time a workflow
+      runs. The committed-tree equivalent ("a file that should be gitignored is
+      tracked") is a different invariant and would need its own mode, so this is not
+      the local-only-by-neglect case the manifest warns about.

package/src/config/discovery/packs.yml

@@ -62,6 +62,11 @@
   description: Laravel framework patterns; depends on PHP at the artefact level.
   workspaces: [engineering]
   requires: [php, engineering-base]
+  # The design layer is a companion, not a dependency: this pack ships UI
+  # executors (blade-ui, flux, livewire) whose grounded selection lives in
+  # frontend-design, but a Laravel API-only project needs none of it. Advisory
+  # so the wizard offers it; `requires` would force the weight on every install.
+  suggests: [frontend-design]
   cluster: php
   trust_level_default: professional
   domain: engineering
@@ -98,6 +103,8 @@
   description: React framework patterns.
   workspaces: [engineering]
   requires: [javascript, engineering-base]
+  # Companion, not dependency — see the note on `laravel`.
+  suggests: [frontend-design]
   cluster: typescript
   trust_level_default: professional
   domain: engineering

package/src/config/evaluator-budgets.json

@@ -8,7 +8,7 @@
         "unpacked_size_mb": {
             "max": 28,
             "last_measured": 26.05,
-            "method": "npm pack --json → dist.unpackedSize / 1e6 — includes the Phase-1 precompiled bundles (dist/hooks/dispatch.js + dist/mcp/server.mjs, ~2.1 MB) that bought the 23x hook-latency win and the tsx removal"
+            "method": "npm pack --json → dist.unpackedSize / 1e6 — includes the Phase-1 precompiled bundles (dist/hooks/dispatch.js + dist/mcp/server.mjs, ~2.1 MB) that bought the 23x hook-latency win and the tsx removal, plus dist/cli-delegate/ (~1.40 MB, ADR-204) which finished that removal for the consumer command surface. This gate is the ONLY size trip-wire on those bundles by design: a dedicated per-bundle budget key would need its own measurement wired into evaluator_umbrella.sh, and an unwired key fails check_evaluator_budgets with 'no measurement supplied' instead of guarding anything. ADR-204 projected 27.45 against max 28 without packing — the next real measurement here is the confirming one, and headroom is thin"
         },
         "node_modules_mb": {
             "max": 140,

package/src/config/gate-coverage.yml

@@ -0,0 +1,127 @@
+# Gate coverage manifest — the input to `check_gate_coverage.ts`.
+#
+# WHY THIS EXISTS
+# ---------------
+# On 2026-07-29 a sweep found gates that scanned a tree emptied by the ADR-051
+# flat-`src/` migration, reported success, and were wired into CI. One printed
+# `TOTAL | 0 | 0 | 0 | 0%`; another printed "All 0 auto-rule descriptions ≤ 150
+# chars"; a third "clean (0 declarer(s))". Each exited 0. A gate that inspects
+# nothing does not pass — it certifies coverage that does not exist, which is
+# worse than having no gate, because the green is believed.
+#
+# Per-case retargeting does not close this: the next migration recreates it. This
+# manifest plus the guard closes it structurally.
+#
+# THE CONTRACT (three rules, each from a real failure)
+# ----------------------------------------------------
+# 1. MACHINE-READABLE COUNT. Every listed gate emits exactly one line
+#    `scanned: <N>` (stdout or stderr), N = artefacts it actually inspected. The
+#    guard never parses a gate's human output — that would make the guard itself
+#    fragile, and a fragile guard is the thing being replaced.
+#
+# 2. CI-IDENTICAL INVOCATION. `argv` MUST match how CI/Taskfile calls the gate.
+#    A bare probe produced a false alarm during the sweep: `skill_linter` looked
+#    blind when called with no arguments, but CI passes `--all` and it scans 429
+#    artefacts. The guard must reproduce the real call or it invents defects.
+#
+# 3. BASELINE, NOT `> 0`. `min_scanned` is a floor, not a zero-check. A gate that
+#    drops from 428 artefacts to 3 is as broken as one that drops to 0, and `> 0`
+#    cannot see it. Set the floor below the true corpus (room for legitimate
+#    deletions) but far above a collapse.
+#
+# FIELDS
+#   id           script stem under src/scripts/
+#   argv         CI-identical arguments (list; empty list = bare call)
+#   min_scanned  hard floor; guard fails when the reported count is below it
+#   corpus       what the count means — so a future reader can re-derive the floor
+#   status       enforced | pending
+#                pending = not yet emitting `scanned:`. The guard REPORTS these
+#                rather than skipping silently: its own partial coverage must be
+#                visible, or it repeats the sin it exists to catch.
+gates:
+  - id: check_condensation
+    argv: []
+    min_scanned: 380
+    corpus: "src/ ↔ dist/agent-src/ .md pairs (429 at baseline: 111 rules + 318 skills)"
+    status: enforced
+
+  - id: check_augment_description_cap
+    argv: []
+    min_scanned: 80
+    corpus: "auto-type rules carrying a description (98 at baseline)"
+    status: enforced
+    note: >
+      Retargeted 2026-07-29 from the ADR-051-emptied tree (0 -> 98). It printed
+      "All 0 auto-rule descriptions" and exited 0 in CI. Retargeting surfaced 16
+      real violations (max 189 chars); all 16 were shortened under explicit
+      operator review, with every matching term programmatically verified as
+      preserved. The cap was deliberately NOT raised to fit the violations —
+      letting a gate adapt to the as-is state is the inversion that produced three
+      blind gates in the first place.
+
+  - id: lint_load_context
+    argv: []
+    min_scanned: 180
+    corpus: "md files inspected for a load_context block: src/rules + src/agent-src/contexts + agents/settings/contexts (231 at baseline, 17 declarers)"
+    status: enforced
+    note: >
+      Retargeted 2026-07-29 from the ADR-051-emptied tree: 0 -> 231 files, and it
+      immediately found a real violation the blindness had hidden
+      (src/rules/model-recommendation.md declared `../contexts/…`, a disallowed
+      relative root; normalised to the canonical `contexts/…` the rule's own prose
+      already used). The count is FILES INSPECTED, not declarers — "0 declarers"
+      over 400 files is legitimate, "0 files" is blindness, and reporting declarers
+      would have hidden exactly this dead root. LEGACY_PREFIX was deliberately NOT
+      retargeted: it detects stale pre-relocation entries and must keep
+      pointing at the old form.
+
+  - id: skill_linter
+    argv: ["--all"]
+    min_scanned: 380
+    corpus: "skills + rules under artefact_roots() (429 at baseline)"
+    status: enforced
+    note: >
+      NOT blind — the manifest's regression case for rule 2. The sweep's bare
+      probe made it look blind; `--all` scans 429. Enforced precisely so that
+      changing `argv` to a bare call fails the guard instead of silently
+      reproducing the false alarm.
+
+  - id: check_no_roadmap_refs
+    argv: []
+    min_scanned: 700
+    corpus: "stable artefacts across src/{rules,skills,agent-src/*} + docs/ + agents/settings/contexts (872 at baseline)"
+    status: enforced
+    note: >
+      Retargeted 2026-07-29 from the ADR-051-emptied tree. It had been enforcing the
+      no-roadmap-references rule for docs/ only while the rule + skill layer went
+      unscanned — 0 -> 872 artefacts. No violation had slipped through (verified),
+      so this closed a latent gap, not a live breach.
+
+  - id: check_context_paths
+    argv: []
+    min_scanned: 900
+    corpus: "reference corpus: src/{rules,skills,agent-src/commands,agent-src/contexts,domains} + agents/roadmaps (1170 at baseline)"
+    status: enforced
+    note: >
+      Retargeted 2026-07-29. An empty reference corpus makes every "unreferenced
+      context" verdict vacuous, which is how the dead root stayed invisible.
+
+  - id: check_site_links
+    argv: []
+    min_scanned: 20
+    unavailable_exit: 2
+    corpus: "built HTML pages under site/dist (25 content sources at baseline)"
+    status: enforced
+    note: >
+      Registered 2026-07-30 after it was caught reporting green over a stale build —
+      6 pages against 25 content sources, every source newer than the newest page.
+      The missing-dist path already exited 2; the stale path did not, so the gate
+      could pass while inspecting a build that did not contain the pages under test.
+      It now exits 2 on stale, and the floor here catches the partial-build case the
+      guard exists for. The lesson of the find is the manifest, not the gate: the
+      guard never flagged this because the gate was never listed. A sibling
+      silent-green found in the same sweep — the per-pack lint matrix, whose path was
+      a double ADR-051 casualty and which exited 0 on an empty match across 17 CI
+      shards — is NOT listed here because it was deleted rather than repaired
+      (skill_linter --all already covers all 429 artefacts in 0.5s).
+

package/src/config/pack-size-budget.json

@@ -0,0 +1,27 @@
+{
+    "_comment": "Payload budget for the published npm tarball (road-to-zero-ceremony-install Phase 4). MEASURED, NEVER INVENTED — the numbers below come from `npm pack --dry-run --json --ignore-scripts` on the tracked tree at 9.9.0 (2026-07-31). Two metrics, both genuinely ungated before this file: COMPRESSED tarball size, and PER-SKILL share of the skills subtree. The UNPACKED size is deliberately absent — it is already owned by src/config/evaluator-budgets.json (unpacked_size_mb), and a second number for one lever is how three conflicting figures start circulating.",
+    "schema_version": 1,
+    "owner": "maintainer",
+    "review_by": "2027-07-31",
+    "regression_pct": 10,
+    "measurement_conditions": "npm pack --dry-run --json --ignore-scripts, run at the repo root on a clean checkout. `--ignore-scripts` means NO build runs, so dist/cli, dist/ui, dist/mcp and dist/hooks are absent and the figure covers only the TRACKED payload (src/scripts/, dist/agent-src/, dist/install/, docs/guidelines/, templates). That is deliberate: this gate is always-on for every PR, and the tracked content tree is exactly the surface that grows by accretion. The built artifact is ~5.4 MB larger and is gated separately, at release time, by evaluator-budgets.unpacked_size_mb.",
+    "budgets": {
+        "packed_size_mb": {
+            "max": 6.4,
+            "last_measured": 5.903,
+            "method": "npm pack --dry-run --json --ignore-scripts → dist.size / 1e6 (the compressed tarball a consumer actually downloads)"
+        }
+    },
+    "per_skill_share": {
+        "max_pct": 5.0,
+        "basis": "a single skill's share of the total bytes under dist/agent-src/skills/ in the tarball",
+        "rationale": "Measured 2026-07-31: the largest non-excepted skill is corpus-grounding at 2.33%, so a 5% cap is green with better than 2x headroom and red for any skill that doubles. It is a falsifiable gate, not a ritual one.",
+        "exceptions": {
+            "design-intelligence": {
+                "max_pct": 23.0,
+                "measured_pct": 22.63,
+                "reason": "771 KB of BM25 corpus (27 CSVs + 16 design-language prose specs + manifest.json) consumed at runtime by corpus-grounding's retriever, and referenced by 6 further skills. Moving it behind a lazy fetch would add a network dependency to a skill that works offline today — the same trade-off ADR-061 §8 already REJECTED for a 745 KB font index. The exception is visible debt, not an endorsement: raising max_pct requires a reason in the same commit."
+            }
+        }
+    }
+}

package/src/config/preamble-payload-budget.json

@@ -0,0 +1,44 @@
+{
+    "_comment": "Per-spawn preamble payload ceiling (road-to-cache-economy Phase 3), unblocked by C-3 measuring 38.0% against a 15% bar. This is a RATCHET, not the roadmap's literal candidate numbers: those (median 40k / p95 50k) were anchored to an upstream ~37k baseline, while this package's own deterministic in-repo payload is ~102.5k tokens — a hard 40k gate would be red on the day it lands and would teach the reader to ignore it. The ratchet fails on GROWTH instead, so the number can only walk down, and the 40k/50k target stays recorded as the destination. Only the deterministic, in-repo buckets are gated: user-scope rules depend on what the developer happens to have installed globally and are therefore not CI-checkable.",
+    "schema_version": 1,
+    "registered_at": "2026-07-30",
+    "owner": "maintainer",
+    "review_by": "2027-07-30",
+    "metric": {
+        "basis": "chars/4 token estimate over the projected tree, produced by src/scripts/preamble_byte_census.ts",
+        "gated_buckets": [
+            "project-scope rules (dist/agent-src/rules/*.md)",
+            "preloaded skills catalog (name + description, dist/agent-src/skills)",
+            "CLAUDE.md hierarchy (project + project-local)"
+        ],
+        "excluded_buckets": [
+            "user-scope rules (~/.claude/rules/*.md) — machine-dependent, not CI-checkable",
+            "tool definitions + dispatch prompt — no local source carries the request payload; the census reports it as an explicit residual"
+        ]
+    },
+    "baseline_tokens": 102520,
+    "baseline_history": [
+        {
+            "tokens": 102599,
+            "at": "2026-07-30",
+            "why": "registered with the gate"
+        },
+        {
+            "tokens": 102520,
+            "at": "2026-07-31",
+            "why": "free tightening: the measured tree came in 79 tok under the registered baseline, so the ratchet walks down to meet it. Not a claimed reduction — nothing was optimised; the point of a ratchet is that a lower measurement becomes the new ceiling instead of becoming unused headroom."
+        }
+    ],
+    "headroom_pct": 5,
+    "target_tokens": {
+        "median": 40000,
+        "p95": 50000,
+        "_comment": "The roadmap's candidate numbers, kept as the destination. Reaching them needs reductions this package has not built yet; scope-dedup (C-3) removes a redundant COPY at the consumer, it does not shrink the suite itself."
+    },
+    "reference_measurements": {
+        "measured_cold_start_median_tokens": 230930,
+        "c3_scope_dedup_reduction_pct": 38,
+        "c3_condition": "FIXTURE-ONLY as of 2026-07-31: the 38% was measured on a byte-identical two-scope fixture, and that condition is currently unreachable for every consumer because install.ts:2723/2725 stamp package:/source_path: into every installed rule while the in-repo projection stamps nothing. Aligning versions yields 0/110 twins, not 110/110. The figure is the mechanism's ceiling, NOT a realised saving, and this baseline therefore assumes no dedup. Reachability is the subject of road-to-dedup-reachability; run measure_scope_dedup for the live split.",
+        "_comment": "The measured median comes from Claude Code transcripts (deduped by message.id + requestId) and is context for the ratchet, never the gated number — it moves with the developer's own session history."
+    }
+}

package/src/install/emit_host_rules_cli.ts

@@ -21,7 +21,8 @@
  *     the Phase-1b rule filter, so scoped installs get scoped host files
  *     for free;
  *   - re-using the exported emitters keeps consumer output byte-identical
- *     to the maintainer projection (Pipeline B never drifts from A).
+ *     to the maintainer projection (the consumer install never drifts from
+ *     Pipeline A, the source projection into `dist/agent-src/`).
  * The trade-off (node required at install time) matches the rule-scope
  * resolver: no node → install.sh keeps its legacy fallback surfaces.
  *

package/src/install/rule_scope.ts

@@ -1,7 +1,11 @@
 /**
- * Install-time rule scoping — Pipeline B of consumer-scoped rule projection
+ * Install-time rule scoping for the consumer install
  * (road-to-request-scoped-rule-load Phase 1b).
  *
+ * Naming: this is the CONSUMER INSTALL path, not `docs/architecture.md`'s
+ * Pipeline B (which is the `.augment/` projection). Earlier drafts called it
+ * "Pipeline B" and collided with that name; use "the consumer install" here.
+ *
  * The projection filter (`rule_in_scope`, condense.ts) covered only the
  * maintainer projection; the consumer install pipeline shipped rules
  * unfiltered (dead `EXCLUDE_RULES` in install.sh; no exclude at all on the

package/src/install/toolDetection.ts

@@ -71,6 +71,44 @@ export function knownToolIds(): readonly string[] {
     return Object.keys(TOOL_SIGNALS);
 }
 
+/**
+ * Executable names declared for `id` on `$PATH`, in table order. Empty for
+ * tools detected only by a config dir / app bundle (and for the two
+ * signal-less ids). Exposed so callers that need the resolved *path* (not
+ * just a boolean) can reuse this table instead of restating the binary names.
+ */
+export function toolBinaries(id: string): readonly string[] {
+    return TOOL_SIGNALS[id]?.bins ?? [];
+}
+
+/**
+ * First declared binary for `id` that resolves on `$PATH`, or `null`. This is
+ * the path-returning twin of `detectInstalledTools`, which reports presence as
+ * a boolean across all three signal kinds — a tool can be "installed" (config
+ * dir present) while this returns `null` (no executable on `$PATH`).
+ */
+export function resolveToolBinary(id: string, pathEnv?: string): string | null {
+    const env = pathEnv ?? process.env['PATH'] ?? '';
+    for (const bin of toolBinaries(id)) {
+        const resolved = resolveBinaryPath(bin, env);
+        if (resolved !== null) return resolved;
+    }
+    return null;
+}
+
+/** Absolute path of `name` on `pathEnv`, or `null`. Mirrors `binOnPath`'s probe order. */
+function resolveBinaryPath(name: string, pathEnv: string): string | null {
+    if (pathEnv.length === 0) return null;
+    for (const dir of pathEnv.split(delimiter)) {
+        if (dir.length === 0) continue;
+        for (const candidate of [name, `${name}.exe`, `${name}.cmd`]) {
+            const full = join(dir, candidate);
+            if (existsSync(full)) return full;
+        }
+    }
+    return null;
+}
+
 /**
  * Is an executable named `name` resolvable on `$PATH`? Exported for one-off
  * presence checks (e.g. `rtk` on the Editor-and-tooling step). Defaults to
@@ -81,14 +119,7 @@ export function isBinaryOnPath(name: string, pathEnv?: string): boolean {
 }
 
 function binOnPath(name: string, pathEnv: string): boolean {
-    if (pathEnv.length === 0) return false;
-    for (const dir of pathEnv.split(delimiter)) {
-        if (dir.length === 0) continue;
-        if (existsSync(join(dir, name))) return true;
-        // Windows-style executables.
-        if (existsSync(join(dir, `${name}.exe`)) || existsSync(join(dir, `${name}.cmd`))) return true;
-    }
-    return false;
+    return resolveBinaryPath(name, pathEnv) !== null;
 }
 
 function isToolInstalled(signal: ToolSignal, home: string, pathEnv: string): boolean {

package/src/install/wizard-plan.ts

@@ -193,8 +193,8 @@ export function expandWizardSources(inputs: WizardExpandInputs): PlanSource[] {
             const srcDir = join(packageRoot, srcRel);
             const destDir = destSub.length === 0 ? destRoot : join(destRoot, destSub);
             // Rule sources get the install-time scoping filter — the same
-            // predicate the projection path uses (Phase 1b: Pipeline B may
-            // never drift from Pipeline A).
+            // predicate the projection path uses (Phase 1b: the consumer
+            // install may never drift from Pipeline A, the source projection).
             const isRuleSource = srcRel === 'dist/agent-src/rules';
             out.push({
                 toolId,

package/src/scripts/_cli/cmd_conformance.ts

@@ -37,6 +37,7 @@ import * as installed_tools from '../_lib/installed_tools.js';
 import { atomicAppendLine } from '../../install/atomic.js';
 import { readRecentEntries } from '../../install/txlog.js';
 import { detectToolPresence } from '../../install/detect.js';
+import { resolvePackageRoot } from '../_lib/package_root.js';
 import {
     _classify,
     _collect_manifest_entries,
@@ -56,7 +57,7 @@ type Dict = Record<string, unknown>;
 const _HERE = fileURLToPath(import.meta.url);
 
 /** Package root — two levels above `src/scripts/_cli/`. */
-export const PACKAGE_ROOT = path.resolve(path.dirname(_HERE), '..', '..', '..');
+export const PACKAGE_ROOT = resolvePackageRoot(import.meta.url);
 
 /** Ordered registry of conformance check identifiers. */
 export const CONFORMANCE_CHECK_IDS = [

package/src/scripts/_cli/cmd_converge.ts

@@ -39,6 +39,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as YAML from 'yaml';
 
 import * as user_global_paths from '../_lib/user_global_paths.js';
+import { resolvePackageRoot } from '../_lib/package_root.js';
 
 type Dict = Record<string, unknown>;
 
@@ -67,7 +68,7 @@ const _HERE = fileURLToPath(import.meta.url);
 
 /** Resolve the @event4u/agent-config package root (this repo). */
 function _package_root(): string {
-    return path.resolve(path.dirname(_HERE), '..', '..', '..');
+    return resolvePackageRoot(import.meta.url);
 }
 
 const SETTINGS_FILENAME = 'agent-settings.yml';