@event4u/agent-config 9.9.0 → 9.11.0

package/src/scripts/release.ts

@@ -771,11 +771,71 @@ function _changelog_line(c: Commit): string {
 
 const _TEST_COUNT_LINE_RE = /^Tests:\s+(\d+)/m;
 
+/**
+ * Buffer ceiling for the `vitest list` probe, in bytes.
+ *
+ * `spawnSync` buffers the child's whole stdout in memory and fails with
+ * ENOBUFS past `maxBuffer`, whose default is 1 MiB. The probe emits one line
+ * per test case, so its output grows with the suite: at 9470 cases the listing
+ * is ~1.25 MB, i.e. already past the default. That is what silently dropped
+ * the footer from the 9.10.0 notes and turned the `changelog-entry` gate red.
+ * 64 MiB is ~50× the current listing — headroom for a suite many times this
+ * size, at no cost when the output is small.
+ */
+const _TEST_LIST_MAX_BUFFER = 64 * 1024 * 1024;
+
+/**
+ * Count test cases from a finished `vitest list` spawn result, or return null
+ * when the probe did not produce a usable listing.
+ *
+ * Split out from `_count_tests_current` so the failure modes are testable
+ * without spawning the real (~14s, >1 MB) collection. `warn` is injected for
+ * the same reason; it defaults to stderr.
+ */
+function _count_from_list_result(
+    res: {
+        error?: (Error & { code?: string }) | undefined;
+        status: number | null;
+        stdout: string | null;
+    },
+    warn: (msg: string) => void = (msg) => void process.stderr.write(msg),
+): number | null {
+    // The trend line is informational and never blocks a release — but a
+    // SILENT drop is what shipped 9.8.0 and 9.10.0 without a footer, so every
+    // degradation says why. The `changelog-entry` CI gate treats a missing
+    // footer as fatal, so this warning is the difference between fixing the
+    // probe now and finding out from a red release PR.
+    if (res.error) {
+        // ENOENT (no npx) · ETIMEDOUT · ENOBUFS (listing past maxBuffer).
+        const code = res.error.code ?? res.error.message;
+        warn(
+            `⚠️  test-count probe failed (${code}) — the \`Tests:\` footer will ` +
+                `be omitted from the release notes, which fails the ` +
+                `\`CHANGELOG entry exists for head version\` gate.\n`,
+        );
+        return null;
+    }
+    if ((res.status ?? 1) !== 0) {
+        warn(
+            `⚠️  test-count probe exited ${res.status ?? '(null)'} — the ` +
+                `\`Tests:\` footer will be omitted from the release notes.\n`,
+        );
+        return null;
+    }
+    const lines = (res.stdout ?? '').split('\n').filter((l) => l.trim().length > 0);
+    if (lines.length === 0) {
+        warn('⚠️  test-count probe listed 0 cases — the `Tests:` footer will be omitted.\n');
+        return null;
+    }
+    return lines.length;
+}
+
 /**
  * Return the collected vitest test-case count on the current tree
  * (`npx vitest list`, one line per case; ~14s wall). Returns null when
  * collection fails — the trend line is informational, never a release
- * blocker. (Replaced the dead `pytest --collect-only` probe on 2026-07-08,
+ * blocker, but every failure warns (see `_count_from_list_result`).
+ * (Replaced the dead `pytest --collect-only` probe on 2026-07-08,
  * road-to-truth-and-reference-hygiene Phase 3: the Python suite was retired
  * with ADR-200, so the old probe always degraded to null and the `Tests:`
  * footer silently vanished from release notes.)
@@ -794,16 +854,9 @@ function _count_tests_current(): number | null {
         encoding: 'utf-8',
         stdio: ['ignore', 'pipe', 'pipe'],
         timeout: 180_000,
+        maxBuffer: _TEST_LIST_MAX_BUFFER,
     });
-    if (res.error) {
-        // ENOENT or ETIMEDOUT → null (informational line dropped).
-        return null;
-    }
-    if ((res.status ?? 1) !== 0) {
-        return null;
-    }
-    const lines = (res.stdout ?? '').split('\n').filter((l) => l.trim().length > 0);
-    return lines.length > 0 ? lines.length : null;
+    return _count_from_list_result(res);
 }
 
 /**
@@ -1986,6 +2039,8 @@ export {
     latest_tag,
     _render_test_trend_line,
     _previous_test_count_from_changelog,
+    _count_from_list_result,
+    _TEST_LIST_MAX_BUFFER,
     Commit,
     Plan,
     SystemExitError,

package/src/scripts/router_telemetry.ts

@@ -595,7 +595,7 @@ export function aggregate_replay(
           // Skip kernel — always-on by definition, no signal.
           continue;
         }
-        seen_in_prompt.set(`${act.tier}${String(rid)}`, [act.tier, String(rid)]);
+        seen_in_prompt.set(`${act.tier}\0${String(rid)}`, [act.tier, String(rid)]);
       }
       const activated_ids = new Set<string>();
       for (const [, rid] of seen_in_prompt.values()) {

package/src/scripts/second_brain_retrieval.ts

@@ -193,13 +193,22 @@ export async function run(opts: { mode: 'dry-run' | 'live'; host: string; seeds:
         const { topk, rank, tieSetSize } = retrieveFor(task, type, k);
         const ids = topk.map((r) => r.id);
         topkSlots += topk.length;
+        // Apply the floor ONCE, here, and prompt from the result below. The
+        // previous shape computed a sanitized body only to increment
+        // `poisonedNeutralized` and then prompted with the RAW body — so
+        // `poisoned_rejection_rate` measured the algorithm while the pipeline
+        // forwarded every vector intact. Measured, not inferred:
+        // `agents/evidence/reports/sanitize-floor-wiring.md` § Finding 2.
+        const safeBodies = new Map<string, string>();
         for (const hit of topk) {
+            const clean = sanitize_text(hit.body);
+            safeBodies.set(hit.id, clean);
             if (staleSet.has(hit.id)) staleHits += 1;
             if (poisonedSet.has(hit.id)) {
                 poisonedRetrieved += 1;
-                // Rejection = the sanitize floor strips every hidden-instruction
-                // vector before the body could reach a prompt.
-                const clean = sanitize_text(hit.body);
+                // Rejection = the sanitize floor stripped every
+                // hidden-instruction vector from the body that reaches the
+                // prompt — the same `clean` value, not a parallel computation.
                 if (!/[​-‏‪-‮⁦-⁩]/u.test(clean)) poisonedNeutralized += 1;
             }
         }
@@ -215,7 +224,8 @@ export async function run(opts: { mode: 'dry-run' | 'live'; host: string; seeds:
                 if (opts.mode === 'dry-run') {
                     transcript = stub(task, arm, neededInTopK);
                 } else {
-                    const r = await callAnthropic(opts.host, _prompt(task, arm, topk.map((x) => x.body), placebo), apiKey);
+                    const retrieved = topk.map((x) => safeBodies.get(x.id) ?? sanitize_text(x.body));
+                    const r = await callAnthropic(opts.host, _prompt(task, arm, retrieved, placebo), apiKey);
                     transcript = r.text; calls += 1; tIn += r.tokens_in; tOut += r.tokens_out;
                 }
                 armTotal[arm] += 1;

package/src/scripts/skill_linter.ts

@@ -3642,6 +3642,11 @@ export function format_text(results: LintResult[], quiet = false): string {
     const passes = results.filter((r) => r.status === 'pass').length;
     const suffix = maliceTotal ? `, ${maliceTotal} malice` : '';
     lines.push(`Summary: ${passes} pass, ${warns} warn, ${fails} fail, ${total} total${suffix}`);
+    // Gate-coverage contract (src/config/gate-coverage.yml): one machine-readable
+    // count so `check_gate_coverage` never parses the human summary above. This
+    // gate is also the manifest's regression case for CI-identical invocation —
+    // called bare it legitimately scans 0, so the manifest pins `--all`.
+    lines.push(`scanned: ${total}`);
     return lines.join('\n');
 }
 

package/src/scripts/surface-tiers.yml

@@ -33,7 +33,9 @@ clusters:
   ai-image: lab          # AI image-generation adapters (pack ai-image, experimental)
   ai-video: lab          # AI video pipeline adapters (pack ai-video, experimental)
   ai_council: lab         # multi-model council orchestration, external API deps
+  ai_team: lab            # multi-agent team dispatch + review gate — ai_council's sibling, external API deps
   command_suggester: lab # context-aware command suggestion engine, pilot
+  code_graph: lab        # native code-graph engine — default-off and benchmark-gated per ADR-124
   cost: lab              # cost tracking / budget gate (observability, Node .mjs)
   mcp_exec: lab          # compiled safety envelope for MCP exec-tier tools (run_tests pilot)
   mcp_server: lab        # MCP stdio server, separate runtime, pilot distribution

package/src/server/schemas/settings.ts

@@ -223,6 +223,14 @@ export const settingsSchema = z.object({
             'Consumed by the doc-screenshot-hygiene rule. on (default) = a data-bearing screenshot embed is gated behind this-turn human confirmation; uncertain/unresolved regions redact-or-refuse, never ship-and-hope; illustrative/no-data screenshots may embed with a stated justification. off = no data-bearing gate (the anonymization taxonomy still applies).',
         ),
     }).default({ identity_allowlist: [], forbid_terminal_capture: true, data_bearing_gate: 'on' }),
+    telegraph: z.object({
+        speak: z.boolean().default(false).describe(
+            'Whether the telegraph-speak rule ships at all. false (default) = DORMANT: compile_router omits the rule from dist/router.json entirely, so its body never reaches a host. This — not speak_scope — is the lever that stops the cost. Set true only after an output-side bench clears the kill-criterion bar (docs/adrs/telegraph/0002).',
+        ),
+        speak_scope: z.enum(['off', 'reply', 'all']).default('off').describe(
+            "Where telegraph condensation applies WHEN speak is true. off (default) = agent reply prose is exempt. compile_router never reads this key: with speak false the rule does not ship, so this setting has no effect on its own. Quote the value in YAML — bare `off` parses as a boolean under YAML 1.1 and is rejected.",
+        ),
+    }).default({ speak: false, speak_scope: 'off' }),
     tokens: z.object({
         rich_skills: richSkillsMode.default('on').describe(
             'Whether skills marked token_budget_class: rich may load in full (exempt from telegraph-speak + thin-projector trimming), consumed by the token-budget-discipline rule. on = allowed (default); off = fall back to standard condensed behavior; ask = surface an estimated token delta (tokens, not dollars) and ask once per session before loading.',

package/src/shared/userMd/utils.ts

@@ -89,3 +89,34 @@ export function parseLegacyUserMd(body: string): Record<string, unknown> {
     }
     return data;
 }
+
+/**
+ * Compose a legacy `.agent-user.md` body (fenced YAML frontmatter + a body
+ * tail) from a plain object — the write-side counterpart to
+ * `parseLegacyUserMd`. Used by
+ * `agent_user_profile.applyObservationToGlobalProfile` (road-to-global-user-memory
+ * Phase 2) to write the accepted-observation profile back in the same shape
+ * it was read in.
+ *
+ * `notes` renders as the body tail verbatim, WITHOUT an added `# Notes`
+ * heading — `parseLegacyUserMd` captures everything after the closing fence
+ * as `notes` as-is (it does not strip a heading back out), so adding one
+ * here would not round-trip: re-parsing the composed file would return
+ * `"# Notes\n\n<text>"` instead of `<text>`. (The convention of putting a
+ * literal `# Notes` heading in a hand-authored `.agent-user.md` — see
+ * `docs/examples/agent-user.example.md` — is an authoring style, not a
+ * structural marker the parser recognises; a file authored that way simply
+ * has that heading as the leading line of ITS `notes` value.) Every other
+ * key stays in the frontmatter block, in block style (matches
+ * `composeUserIdentity`'s diff-friendliness rationale).
+ *
+ * Drop alongside `parseLegacyUserMd` once `.agent-user.md`-shaped files are
+ * no longer in circulation.
+ */
+export function composeLegacyUserMd(data: Record<string, unknown>): string {
+    const { notes, ...frontmatter } = data;
+    const yamlBody = yaml.dump(frontmatter, { flowLevel: -1, lineWidth: -1, noRefs: true });
+    const notesText = typeof notes === 'string' ? notes.trim() : '';
+    const notesSection = notesText === '' ? '' : `\n${notesText}\n`;
+    return `---\n${yamlBody}---\n${notesSection}`;
+}

package/dist/agent-src/rules/telegraph-speak.md

@@ -1,87 +0,0 @@
----
-type: "auto"
-tier: "1"
-description: "telegraph.speak_scope != off — telegraph the prose; carve-outs (options, Iron-Law, code, paths) stay byte-stable"
-triggers:
-  - intent: "any reply"
-workspaces: [agent-config-maintainer]
-packs: [meta]
-enforced_by:
-  - "observer:maintainer-review"
----
-
-# Telegraph Speak
-
-Condense reply prose to telegraph grammar per `telegraph.speak_scope`. Body
-prose only — carve-outs preserved byte-for-byte.
-
-## Scope
-
-Read `telegraph.speak_scope` from `.agent-settings.yml`:
-
-- `off` — rule inactive.
-- `prose_only` (default) — telegraph in body prose; carve-outs preserved.
-- `aggressive` — telegraph everywhere except Iron-Law literals.
-
-Compile-time toggle `telegraph.speak`: `false` → rule omitted from
-`dist/router.json` (zero runtime cost). `telegraph.enabled: false` forces all
-sub-switches off regardless.
-
-## Carve-outs — byte-for-byte preserved
-
-Mangling these breaks Iron Laws. Apply regardless of `speak_scope`:
-
-1. **Triple-backtick ALL-CAPS blocks** — Iron-Law literal fences in
-   `commit-policy`, `non-destructive-by-default`, `direct-answers`, etc.
-2. **Numbered-options blocks** — lines matching `^>?\s*\d+\.\s` plus
-   the `**Recommendation:**` / `**Empfehlung:**` label
-   (`user-interaction` Iron Law 1).
-3. **Code blocks** — any triple-backtick fence, any language.
-4. **Backtick spans** — file paths, command names, identifiers
-   (`direct-answers` Iron Law 2 — no invented facts).
-5. **Status / error markers** — lines prefixed `❌`, `⚠️`, `✅`.
-6. **Mode markers** per `role-mode-adherence`.
-7. **Deliverables** — PR titles / bodies, commit messages, ticket
-   summaries, articles, single-question prompts asked to the user.
-   These are written **for** the user, not chat-prose.
-
-## Enforcement mechanism
-
-Post-rewrite validator runs on every reply when `speak_scope != off`:
-
-1. **Snapshot** — before condensation, hash each line in carve-out
-   regions (1–7 above).
-2. **Rewrite** — condense body prose to telegraph grammar.
-3. **Validate** — re-scan; for each carve-out region whose line hash
-   differs from the snapshot, **restore the original prose**.
-4. **Emit** — the validated reply.
-
-The rule documents the algorithm; agents apply it inline before
-sending. The mechanism is the rule, not a hidden script.
-
-- Optional CI-side regression lock: [`scripts/validate_telegraph_carveouts.ts`](../../scripts/validate_telegraph_carveouts.ts) — pre/post reply pair, byte-identical preservation across all seven carve-out categories; runtime mechanism stays algorithmic, script is the offline check.
-
-## Telegraph grammar
-
-- Drop articles (`the`, `a`, `an`).
-- Drop linking auxiliaries (`is`, `are`, `was`, `be`) where
-  unambiguous.
-- Drop pronouns when context is clear.
-- Keep nouns, verbs, key adjectives, negation, numbers.
-
-Example: *"I will now check the file and see if it exists"* →
-*"Check file. Exists?"*
-
-## Settings
-
-| Key | Default | Effect |
-|---|---|---|
-| `telegraph.enabled` | `true` | Master — `false` forces all sub-switches off. |
-| `telegraph.speak` | `true` | Compile-time include in `dist/router.json`. |
-| `telegraph.speak_scope` | `prose_only` | Runtime scope of telegraph grammar. |
-
-- Input-side memory condensation (shrinking always-loaded memory files like `AGENTS.md` / `CLAUDE.md` / `.cursorrules` rather than the reply stream) runs independently of `speak_scope` — see [`condense-memory`](../skills/condense-memory/SKILL.md) for the script wrapper, sensitive-path refusal contract, and `.original.md` round-trip.
-- Skills marked `token_budget_class: rich` are **exempt** from telegraph condensation + thin-projector trimming (gated by `tokens.rich_skills`, default `on`) — full model in [`token-budget-discipline`](token-budget-discipline.md).
-- Any telegraph/trim decision that would drop a net-positive change purely on budget grounds routes to [`token-budget-discipline § Value-over-budget escalation`](token-budget-discipline.md#value-over-budget-escalation) — surface the trade-off, don't auto-reject.
-
-Cross-rule index: [`frugality-charter § cross-references`](../contexts/contracts/frugality-charter.md#cross-references--frugality-canon-rules).