@hassangameryt/freeflow 0.4.0 → 0.6.0

package/skills/execute-work/references/execution-loop.md

@@ -1,77 +0,0 @@
-# Execute Work Loop
-
-Read this when execution spans multiple bounded actions or slices, resumes from prior state, needs a specialized method, reaches a selected checkpoint, or reveals follow-on work. [Execute Work](../SKILL.md) owns the normal method; this reference expands its directed routes.
-
-## Directed Execution Graph
-
-```text
-[Requested or approved concrete work; effective mode permits mutation]
--> [Orient]
-   source + authority + live state + current slice + stop conditions
--> [Choose one bounded action]
--> [Load one needed method or reference]
--> [Execute]
--> [Test or observe]
--> [Verify the claim at its required boundary]
-   -> clear local defect
-      -> [Correct within authority]
-      -> [Test or observe]
-   -> unclear or repeated failure
-      -> [Diagnose Failure]
-      -> [Workflow routes from the cause]
-   -> contradicted, inconclusive, or route-changing evidence
-      -> [Workflow]
-   -> supported
-      -> [Silent self-review]
-      -> [Correct clear local issue and re-verify, or freeze]
--> [Route from the supported state]
-   -> more accepted work for the same coherent result
-      -> [Choose the next bounded action]
-   -> accepted extension to result / scope / authority / evidence / stop conditions
-      -> [Record write-ahead when a Working Record exists]
-      -> [Choose the next bounded action]
-   -> distinct result, authority, or independently useful evidence boundary
-      -> [Workflow establishes current slice outcome]
-      -> [Select a new authorized slice; use Track Work when present]
-   -> approved checkpoint due
-      -> [Use checkpoint owner]
-      -> [Return its result to Workflow]
-   -> unapproved follow-on work
-      -> [Recommend exact scope and wait]
-   -> supported pause or exit
-      -> [Preserve state and report]
-```
-
-The graph may recur many times inside one Track Work slice. An action, verification run, self-review, review report, or owning-skill call does not create or close a slice by itself.
-
-## Select A Method For The Action
-
-Use only the method needed by the concrete boundary:
-
-- Use [TDD](../../tdd/SKILL.md) for test-first behavior work. Read [Test Design](../../tdd/references/test-design.md) when the test seam, oracle, double, or composed failure is unclear.
-- Use [Simplify Code](../../simplify-code/SKILL.md) for behavior-preserving simplification. Read [Simplification Patterns](../../simplify-code/references/simplification-patterns.md) when choosing or judging a transformation.
-- Use [Design for Depth](../../design-for-depth/SKILL.md) when direct evidence shows design-bearing ownership, interface, state, failure-unit, or coordination pressure. Read [Design Pressure Signals](../../design-for-depth/references/design-pressure-signals.md) or the [Interface Design Loop](../../design-for-depth/references/interface-design-loop.md) only when their deeper branch applies.
-- Use [Diagnose Failure](../../diagnose-failure/SKILL.md) when a failure lacks a supported cause. Read the [Diagnostic Loop Catalog](../../diagnose-failure/references/diagnostic-loop-catalog.md) when choosing a reproduction or distinguishing observation, or [Flaky and Performance Diagnosis](../../diagnose-failure/references/flaky-and-performance.md) for those failure types.
-
-Do not stack methods because several descriptions match. Keep one execution owner and add only the lenses or evidence methods the current action requires.
-
-## Route Selected Checkpoints
-
-A user-approved Plan or explicit discussion may select review, local commit, user-decision, or continuity checkpoints. When one becomes due, do not begin the next bounded action first. Use its owner and return the result to Workflow. If its conditions no longer hold, return the deviation rather than forcing the checkpoint.
-
-Use these separately controlled routes only when already requested or approved:
-
-- [Commit Work](../../commit-work/SKILL.md), with [Staging Decisions](../../commit-work/references/staging-decisions.md) for mixed changed state;
-- [Migration Work](../../migration-work/SKILL.md), with the [Migration Lifecycle](../../migration-work/references/migration-lifecycle.md) for migration units, compatibility, cutover, recovery, or removal proof;
-- [Finish Branch](../../finish-branch/SKILL.md), with [Integration Options](../../finish-branch/references/integration-options.md) for merge, pull request, preservation, or discard;
-- [Release Work](../../release-work/SKILL.md), with [Release Evidence](../../release-work/references/release-evidence.md) for source, version, artifact, tag, publication, or consumer identity;
-- [Launch Work](../../launch-work/SKILL.md), with [Launch Readiness](../../launch-work/references/launch-readiness.md) for production evidence, rollout, signals, or recovery;
-- [Handoff](../../handoff/SKILL.md), with [Handoff Templates](../../handoff/references/templates.md) after destination and purpose are clear.
-
-A checkpoint result may support continuation, correction, another route, deferment, or stopping. It does not authorize the next lifecycle stage automatically.
-
-## Resume Or Return
-
-When resuming, reopen the source that established the work and inspect live state. If a Working Record exists, read its complete current context and slice through [Track Work](../../track-work/SKILL.md); do not reconstruct authority or progress from a summary alone.
-
-Continue only while accepted authority and evidence support the execution basis. Return to [Workflow](../../workflow/SKILL.md) when direction, authority, scope, source truth, strategy, or the intended result changes, or when no worthwhile safe continuation remains.

package/skills/output-router/SKILL.md

@@ -1,206 +0,0 @@
----
-name: output-router
-description: Use after the Workflow, Decision Gate, or Discuss route is clear when choosing between native tools and Freeflow routed tools, retrieving repo/local/vault evidence, transforming bounded evidence, handling unknown-size or broad output, running likely-large/noisy commands, recovering vaulted output, tuning outputRouter/observedRouting/scriptTransform after setup, or handling optional native read/bash safety-net routing.
----
-
-# Output Router
-
-Choose how evidence moves into context.
-
-Freeflow tools are the safe first choice for unknown-size, exploratory, repo-wide, generated/log-adjacent, structured, or likely noisy output, including broad `rg`/`find`/`git`/help/docs scans. Native tools stay direct for known-small, exact, intentionally raw, or mutating work. A post-hoc cap such as `head`, `sed -n`, `tail`, or `wc` does not make a broad producer known-small.
-
-Output Router does not classify the task. Workflow, Decision Gate, or Discuss decides whether to answer, ask, explore, plan, or stop. Output Router starts after that route is clear.
-
-## First Decision
-
-Ask what kind of data you need:
-
-- Existing repo, explicit local, or vault data: use `freeflow_search`.
-- New command or script-produced output: use `freeflow_run`.
-- Several independent Freeflow operations: use `freeflow_batch`.
-- Config/status/vault/script-adapter facts: use `freeflow_status`.
-- Enabled MCP/web/fetch/code-search output: call the host tool directly; Pi observed routing runs after the host result when configured.
-- Known whole file, intentionally exact shell behavior, cmux/Pi control probes, explicit fallback after a routed-source limitation, or edits: use native `read`, `bash`, `edit`, or `write`.
-
-When unsure how much output will return, use Freeflow first. Bound the producer before using native tools; do not rely on trimming the output after a broad command runs.
-
-## `freeflow_search`: Existing Data
-
-Use `freeflow_search` for repo files, explicit external local files, and vaulted output that already exists.
-
-Actions:
-
-- `locate`: find likely paths/output ids first. Use before reading when you only need candidates.
-- `query`: return the best focused evidence packets for a search question.
-- `get`: user gave exact-ish text/code/snippet or asks “where is this?” Find the best match and return source coordinates plus matched content.
-- `retrieve`: you already know the path/outputId and line range. Return those exact lines. Do not use this as search.
-- `expand`: widen a previous evidence packet.
-- `explain`: explain a previous routed decision or vault output/recoverability.
-- `transform`: compute facts or deterministic subsets from repo/local/vault/file/output data.
-
-Use `source.kind="repo"` for the current checkout. Use `source.kind="local"` for external local docs/files with an explicit absolute `root` and optional relative `path`; do not put local roots in shared config. Use `source.kind="vault"` for previous Freeflow outputs.
-
-Vault search patterns:
-
-- Unknown output id: `source.kind="vault"` without `outputId`, plus `query` and optional `filters`.
-- Known output id and unknown line: `action="query"` or `get` with `source.outputId`.
-- Known output id and known line range: `action="retrieve"` with `lineRange`.
-- Metadata-only result: use `action="explain"`; do not claim raw recovery.
-
-Use `preserve="full"` only when exact fidelity matters. It still means exact-under-caps, not unlimited context injection.
-
-## `freeflow_search action=transform`: Processing Existing Data
-
-Use transform when raw data is too large/structured and you need computed facts.
-
-Good transform cases:
-
-- logs: status counts, error rates, slow examples,
-- JSON/CSV: counts, groupings, top values, extracted fields,
-- test/build/typecheck output already in the vault,
-- MCP/web/fetch/code-search payloads already routed into the vault,
-- deterministic regex filtering, match counts, grouping, dedupe, topN, URL/citation extraction, line/size stats.
-
-Prefer deterministic operations when enough:
-
-- `regexFilter`, `countMatches`, `jsonExtract`, `groupByRegex`, `dedupe`, `topN`, `extractUrls`, `extractCitations`, `lineStats`, `sizeStats`.
-
-Use scripts only when deterministic operations cannot express the fact:
-
-- `operation.kind="script"` runs a sandboxed transform over vault sources.
-- `script` without `operation` runs the processing-engine script path over repo/local/vault sources.
-- Sandboxed scripts require `scriptTransform.enabled=true` and a proof-backed adapter.
-- Raw script code is not persisted; metadata stores hashes/labels/limits.
-- No sandboxed script path may silently fall back to host shell execution.
-
-Unsafe unsandboxed processing is local-only, explicit per call, and only through the processing script policy. It must say `unsafe/unsandboxed`. Never put that opt-in in shared config.
-
-## `freeflow_run`: New Output
-
-Use `freeflow_run` when the producer creates new output and routed evidence is enough.
-
-Base producers are mutually exclusive:
-
-- `command`: shell command through the host-approved runner.
-- `script`: sandboxed code-as-producer with no repo/home/env/network/vault access.
-
-Use `command` for:
-
-- tests, builds, lint, typecheck, CI-like checks,
-- broad shell search with unknown output size,
-- commands likely to print logs, JSON, status, or diagnostics,
-- commands whose exact raw output may need recovery.
-
-Use `script` for:
-
-- generating data with code when no repo/home/env/network access is needed,
-- safe code-as-producer execution through the same sandbox engine as transforms,
-- stdout/stderr capture that should route like command output.
-
-Do not use `freeflow_run script` when the code needs repo files, environment variables, network, package imports, or host filesystem access. Use a host command intentionally, or transform an explicitly captured source.
-
-Run modifiers:
-
-- `goal`: tell the router why the run exists, e.g. `verification`, `diagnosis`, `build`, `log analysis`.
-- `filters`: deterministic line filtering over captured stdout/stderr/combined.
-- `scriptFilter`: sandboxed script over already captured stdout/stderr/combined. It never reruns the base producer.
-- `preserve="full"`: request exact output under caps with vault recovery over cap.
-
-Run storage:
-
-- Default `hybrid-dedupe` stores exact output when exactness-sensitive and metadata-only for small non-sensitive successes.
-- Failures, verification/test/build/typecheck/diagnosis output, `preserve="full"`, filters, script filters, reducers, script producers, and large/noisy output are exactness-sensitive.
-- Exact duplicates may store current metadata pointing to a previous exact `outputId`.
-- Plain metadata-only records get rerun guidance, not exact recovery claims.
-
-## `freeflow_batch`: Independent Freeflow Work
-
-Use `freeflow_batch` when several Freeflow-owned `run` or `search` steps can happen independently.
-
-Good batch cases:
-
-- run several bounded searches in parallel,
-- run independent checks and ask `queries[]` to extract facts from child evidence,
-- gather multiple repo/local/vault facts without injecting every child result.
-
-Do not use batch for:
-
-- sequenced workflows,
-- arbitrary external tool orchestration,
-- mutating work,
-- steps where one child needs another child’s output.
-
-Child outputs remain in `details.result.steps`; exact child run output remains recoverable by child `outputId`.
-
-## Native Tools
-
-Use native tools when direct behavior is the point:
-
-- `read`: known whole file or exact direct file content is intended.
-- `bash`: expected-small exact shell behavior, host access, cmux/Pi control probes, or bounded producer behavior is intentionally needed.
-- `edit` / `write`: mutations.
-
-Native `bash`/`read` remain valid for known-small exact checks, cmux/Pi control probes, exact file reads, or explicit fallback after a routed-source limitation; name the limitation and keep the fallback narrow.
-
-Do not run broad native commands just to see what comes back. `head`, `sed -n`, `tail`, `wc`, or similar output caps bound visible text, not producer scope or relevance. Likely-large native commands include repo-wide `rg`, `grep -R`, `find`, package scans, generated-artifact scans, docs/help scans, logs, broad `git diff/log`, full tests/builds/lints/typechecks, and one-off scripts with unknown output size.
-
-If native read/bash safety net is enabled, large/noisy native output may be replaced with labeled Freeflow-routed output. It must include an `outputId` and recovery instructions. If safety-net routing fails, native output passes through with a warning.
-
-## Observed Routing
-
-For enabled Pi MCP/web/fetch/code-search producers, call the host tool directly. Freeflow observes the completed result after host execution.
-
-Observed routing:
-
-- is off by default,
-- is explicit per producer/server,
-- does not grant permissions or block host tools,
-- can persist exact output, metadata-only, or nothing depending on config,
-- fails open with original host output if routing fails.
-
-Mutating MCP/tool calls still require normal workflow/interview judgment before the host call. Observed routing is not permission approval.
-
-## Hard Rules
-
-- Do not pretend routed output is native output.
-- Do not silently shorten native output.
-- Capture raw output before transforming it.
-- Keep raw source recovery separate from transformed/reduced output recovery.
-- Treat `preserve="full"` as exact fidelity under caps, not unlimited context injection.
-- Preserve exact failure and verification evidence lines.
-- Keep `toolStatus`, `execution.status`, and `routing.status` separate.
-- Metadata-only records must never claim exact raw recovery.
-- Freeflow mode changes guidance strength only. It must not enable `postToolRouting`.
-- Do not write removed `capture` or `providers` config.
-- Do not offer `redacted`; it is future-only.
-
-## Recovery Pattern
-
-For routed run/native/observed/transform output, recover exact text with:
-
-```json
-{
-  "action": "retrieve",
-  "source": { "kind": "vault", "outputId": "ffout_...", "stream": "stdout|stderr|combined|raw" },
-  "lineRange": { "start": 1, "end": 20 },
-  "preserve": "full"
-}
-```
-
-When line numbers are unknown, use `query` or `get` first. Use `expand` when a returned evidence packet is too narrow. Use `explain` when recoverability is unclear.
-
-## Config
-
-Use `freeflow_status` to inspect effective config, vault writability/index state, script adapters, observed routing, and migration recommendations.
-
-Use `../setup-freeflow/SKILL.md` for installation, invalid-config repair, or the initial optional-capabilities branch. After valid setup, Output Router owns explicit operational tuning requested through its capability surface.
-
-Persist operational config only after an explicit tuning request or a previously accepted setup branch:
-
-- `outputRouter`: `enabled`, `profile`, `postToolRouting`, `storagePolicy`, thresholds, vault root/retention, generated paths, noisy command hints.
-- `outputRouter.observedRouting`: explicit MCP servers and web/fetch/codeSearch producer persistence.
-- `outputRouter.scriptTransform`: enabled flag, languages, sandbox/network/limits/raw-script persistence.
-
-Minimal setup stays only `defaultMode`. Missing optional sections mean built-in defaults.
-
-Read [the safety policy](references/safety-policy.md) before changing routing policy, reviewing router behavior, or handling exactness-sensitive output.

package/skills/output-router/references/safety-policy.md

@@ -1,40 +0,0 @@
-# Output Router Safety Policy
-
-Reference-only policy for exactness-sensitive output routing. Pi runtime context does not load this whole file by default; the active `output-router` skill carries the compact rules. Read this file before changing routing policy, reviewing router behavior, or handling a new exactness-sensitive output class.
-
-## Main Rule
-
-Do not silently summarize, compress, or replace exactness-sensitive output.
-
-Exactness-sensitive output includes:
-
-- user-requested exact/full output,
-- small native outputs where direct output is expected,
-- verification output needed for completion claims,
-- failure evidence needed for diagnosis,
-- source-truth conflict evidence,
-- security, privacy, billing, data-loss, permissions, or public API evidence,
-- failed, timed-out, or cancelled run output,
-- script-producer output,
-- filtered, script-filtered, reduced, or transformed output where raw source matters,
-- anything marked `preserve: full`.
-
-## Required Behavior
-
-- Capture raw evidence before transformation whenever output is routed.
-- Label every transformed native or observed result as Freeflow-routed output.
-- Include an `outputId` and exact recovery instructions when exact recovery exists.
-- Preserve exact failure and verification evidence lines; do not paraphrase them.
-- Pass small native outputs through unchanged unless explicit config and thresholds route them.
-- For huge exactness-sensitive output, use vaulting and exact chunk retrieval instead of lossy summarization.
-- If post-tool native safety-net routing fails, fail open: return the native output unchanged when possible and include a warning.
-- Keep raw source recovery separate from transformed/reduced output recovery.
-- Metadata-only records must never claim exact raw recovery. Duplicate metadata may point to a prior exact `outputId`; plain metadata-only records get rerun or explanation guidance.
-
-## Non-Goals
-
-- This policy does not enable post-tool routing by itself.
-- This policy does not authorize model-assisted summarization inside the router runtime.
-- This policy does not authorize unsandboxed script execution.
-- This policy does not require Pi runtime context to inject the full reference every turn.
-- This policy does not replace host permissions, sandboxing, approvals, or workflow/decision gates.

package/skills/setup-freeflow/references/output-router-setup.md

@@ -1,110 +0,0 @@
-# Output Router Setup
-
-Use this only when repository setup or repair explicitly includes Output Router, observed routing, generated-path hints, native safety-net routing, vault, thresholds, script-transform adapters, or script-transform repository config.
-
-## Defaults
-
-- Minimal `/setup-freeflow` writes only repository `defaultMode`. `.freeflow/config.json` remains required for activation; a local override cannot activate Freeflow.
-- Output Router is repository-owned and disabled by default.
-- Missing optional sections mean built-in defaults, not setup failure.
-- Normal setup does not ask a generic capability question. If Output Router was not explicitly requested, do not write `outputRouter` config or install script adapters.
-- If the user explicitly opts into Output Router during setup, write `outputRouter.enabled: true` directly. Do not make them run another command afterward.
-- Observed routing is opt-in per producer/server. The user must choose persistence for each enabled entry before setup writes config.
-- Preserve unrelated valid repository and personal settings. Do not copy Output Router config into `.freeflow/local.json`; only documented local-only processing settings belong there.
-- Do not create a separate `setup-output-router` skill.
-
-If the user says only “set up the output router” with no requested knobs, explain that enabling Output Router is enough for the router tools/guidance, then ask which optional subfeatures, if any, they want persisted. Recommend no subfeature config unless they need observed routing, repo-specific hints, script transform setup, or native safety-net behavior.
-
-## Config Shape
-
-Write only keys the user explicitly requests. Do not dump defaults and do not create empty optional objects. Output-router-related config lives under `outputRouter`. Do not write removed `capture` or `providers` config.
-
-Supported shape:
-
-```json
-{
-  "defaultMode": "workflow",
-  "outputRouter": {
-    "enabled": true,
-    "postToolRouting": "safety-net",
-    "thresholds": {
-      "largeOutputBytes": 64000,
-      "largeOutputLines": 2000
-    },
-    "vault": {
-      "root": "~/.cache/freeflow-router/vault",
-      "retention": { "strategy": "ttl", "ttlDays": 7 }
-    },
-    "hints": {
-      "generatedPathGlobs": ["graphify-out/**"],
-      "noisyCommandPatterns": ["npm test"]
-    },
-    "observedRouting": {
-      "enabled": true,
-      "onRoutingFailure": "fail-open",
-      "mcp": {
-        "servers": {
-          "github": { "enabled": true, "persistence": "exact" },
-          "gmail": { "enabled": true, "persistence": "metadata-only" }
-        }
-      },
-      "web": { "enabled": true, "persistence": "exact" },
-      "fetch": { "enabled": true, "persistence": "exact" },
-      "codeSearch": { "enabled": true, "persistence": "exact" }
-    },
-    "scriptTransform": {
-      "enabled": true,
-      "sandbox": "auto",
-      "languages": ["javascript", "python", "jq"],
-      "network": "off",
-      "limits": {
-        "timeoutMs": 5000,
-        "maxInputBytes": 1048576,
-        "maxOutputBytes": 65536
-      },
-      "rawScriptPersistence": "disabled"
-    }
-  }
-}
-```
-
-Rules:
-
-- Top-level `enabled` and `skills.enabled` default to true after setup; write them only when the user explicitly wants to disable Freeflow or the skills layer.
-- `outputRouter.enabled` defaults to `false`; write `true` only when the user chooses Output Router.
-- `postToolRouting` defaults to `off`. Do not write `off`; use `safety-net` only when explicitly requested. Treat `strict` as reserved; ask before writing it.
-- `thresholds.largeOutputBytes`, `thresholds.largeOutputLines`, and `vault.retention.ttlDays` must be positive integers.
-- `vault.root` must be a non-empty string. Repo-local storage requires explicit user choice.
-- `hints.generatedPathGlobs` are broad-scan generated-path hints. Explicit file or directory retrieval must remain available.
-- `hints.noisyCommandPatterns` is parsed as hint config. Do not add it unless the user explicitly asks for command-pattern hints.
-- `observedRouting.enabled` defaults to `false`; write it only when the user chooses observed routing.
-- `observedRouting.onRoutingFailure` currently supports `fail-open`; omit it unless a caller needs an explicit non-default once supported.
-- `observedRouting.mcp.servers` must contain explicit server entries only. Setup may discover configured servers for selection, but must not persist a volatile inventory of every installed tool.
-- `observedRouting.web`, `observedRouting.fetch`, and `observedRouting.codeSearch` are Pi observed-routing producers. Enable only the producers the user chose.
-- Every enabled observed-routing entry needs a user-chosen persistence mode: `exact`, `metadata-only`, or `none`.
-- Recommend `exact` for public-ish evidence producers such as GitHub, web, fetch, and code search. Recommend `metadata-only` for sensitive or unknown producers such as Gmail, Slack, private customer systems, or likely-secret outputs.
-- Do not offer or write `redacted`; it is reserved for future work and currently falls back to `metadata-only` with a warning if hand-edited.
-- Pi public `freeflow_capture` and the separate `providers` setup surface have been removed. Do not write removed `capture` or `providers` config.
-- `scriptTransform.enabled` defaults to `false`; write `true` only after an explicit script-execution opt-in.
-- If the user opts into script transform setup and adapters are missing or unavailable, recommend installing global adapters. On consent, resolve `../../router/dist/setup/script-transform-adapters.js` relative to `skills/setup-freeflow/SKILL.md` and run `node <plugin-root>/router/dist/setup/script-transform-adapters.js install --config .freeflow/config.json`.
-- The installer uses `~/.cache/freeflow-script-adapters` by default, or `FREEFLOW_SCRIPT_TRANSFORM_ADAPTERS_HOME` when set. It installs `quickjs-wasi@3.0.1`, `jq-wasm@1.2.0-jq-1.8.2`, `@bsull/eryx@0.5.0`, and `node@24` for the Python JSPI child runner, writes `freeflow-adapter-env.sh`, probes sandbox proofs, and updates `outputRouter.scriptTransform.languages` with only proof-passing languages.
-- Freeflow auto-discovers adapters from that global cache. The explicit roots `FREEFLOW_QUICKJS_WASI_ROOT`, `FREEFLOW_JQ_WASM_ROOT`, and `FREEFLOW_ERYX_ROOT` remain overrides for custom installs.
-- Python/Eryx is installed by setup and uses the setup-installed child Node process launched with `--experimental-wasm-jspi` when the host process lacks JSPI. It must not be marked available unless that child runner passes the required sandbox probes.
-- `scriptTransform.languages` supports `javascript`, `python`, and `jq`; enable only languages whose adapters passed sandbox proofs.
-- `scriptTransform.sandbox` currently supports `auto`, `network` supports only `off`, and `rawScriptPersistence` supports only `disabled`.
-- `scriptTransform.limits.timeoutMs`, `maxInputBytes`, and `maxOutputBytes` must be positive integers within product caps. Per-call script limits may only tighten configured values.
-
-## Verify
-
-After writing optional capability config, use `freeflow_status` or equivalent direct inspection to verify:
-
-- JSON parses.
-- `defaultMode` is valid.
-- A minimal shared setup with no optional settings contains only `defaultMode`.
-- Newly added `enabled`, `interactionContract`, `skills.enabled`, `outputRouter`, `outputRouter.observedRouting`, and `outputRouter.scriptTransform` keys were requested; preserved valid settings remain unchanged.
-- Invalid router, observed-routing, or script-transform values are not written.
-- Output Router, observed routing, native safety-net routing, and script transform are not enabled unless explicitly requested.
-- If script transform setup was accepted, global adapter install completed or a clear install/probe failure was reported, and enabled languages match proof-passing adapters.
-- No observed-routing entry uses `redacted`, and every enabled entry has explicit persistence.
-- `freeflow_status` shows effective defaults and migration recommendations without rewriting config.
-- No repo-local hooks, skill files, setup-output-router skill, docs inventories, or repo-local storage directories were created.