@ssheleg/agent-stack 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## v0.13.0 — 2026-08-20 — the audit refused a score and computed one
+
+`references/audit.md` said *"a prioritized change plan … **not** a score"* at `:20`, argued
+at `:22-25` that *"a number compresses away the only useful information"*, and then computed
+`P = blast × confidence / effort` at `:114` and ordered the plan by it at `:128`. The
+manifesto backs the refusal in the same words (`manifesto.md:424` — *"these axes are not a
+fake numerical score. They are a reason the team can inspect"*) and names **four** axes at
+`:419-422`: impact, **irreversibility**, uncertainty, **coordination**. Two of them appeared
+nowhere in the pack (`grep -ci irreversib` → 0, `grep -ci coordinat` → 0) and `effort` — a
+cost, not a risk — had been substituted for both.
+
+**Position taken: publish the axes, drop the arithmetic.** The number never did what its own
+paragraph claimed — `3 × 1 / 3` and `1 × 1 / 1` both print 1, so two findings a reviewer
+would rank very differently ranked identically.
+
+Three more, each with its plant:
+
+- **The ledger graded a tree, not an artifact.** Three sections said *unreleased* and
+  *"the version stays 0.11.1 and the CHANGELOG is untouched"* over 35 rows reading
+  `verified` — while v0.12.0 was tagged and published — against this file's own rule that a
+  row sits at `never` until its check has been watched passing **on the shipped artifact**.
+  Re-run against `git archive v0.12.0`, both commands exit 0.
+- **Three of four skill descriptions were past the house working limit**, one with five
+  characters of headroom before the platform's hard 1024. 1019 / 986 / 983 → **964 / 963 /
+  970**, every trigger intact (19→19, 12→12, 14→14), and 970 is a gate now.
+- **`test/plant_guard_test.py` leaked eight nameless temp trees per run and the gate said
+  nothing.** `test/residue.py` is **ported** from `make-skill`, not rewritten; the shared
+  pile went from growing to flat (2568 → 2576 measured, 0 growth from this suite).
+
+**Three guards were wrong first, and watching them fail is the only reason that is known:**
+the scalar check refused the paragraph that records the formula's removal; the ledger check
+read its own citation as a claim; and its `shipped in vX` pattern was **lowercase-only**
+while every real claim is capitalised — so it reported green over a file it had never read.
+
+Also corrected: `checks = 9 + len(skill_dirs)` was a hand-bumped literal that five ledger
+rows quote as evidence a guard was added. The true count at v0.12.0 was **10**, not 13.
+
+Negative self-tests 19 → **26**.
+
+
 ## v0.12.0 — 2026-08-19
 
 Three places where this pack's own doctrine disagreed with the Proof of Done manifesto it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/agent-stack",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "scripts": {
     "test": "python3 test/validate.py && python3 test/plant_guard_test.py"
   },

package/plugins/agent-stack/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "agent-stack",
   "displayName": "Agent Stack",
   "description": "Two skills: agent-orchestrator \u2014 tool-calling loops, multi-stage pipelines with checkpoints, provider routing with fallback, four-layer memory, context engineering, plus the wallet side of reselling LLM access; and agent-evals \u2014 run/trace/thread evals, judges, and fixtures grown from production.",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/agent-stack/skills/agent-evals/SKILL.md

@@ -7,12 +7,11 @@ description: >-
   evals. Covers the three observability primitives (run, trace, thread) crossed with three
   eval granularities (single-step, full-turn, multi-turn), the offline/online/ad-hoc
   timing axis, pass-fail rubrics over scalar scores, cheap code checks before model
-  judges, the checker node as an evaluator running inside the graph, simulated users with
-  adversarial personas, annotation queues, and what to instrument so any of it is
-  possible. Triggers - "agent eval", "eval suite", "LLM judge", "regression fixture",
+  judges, the checker node as an evaluator inside the graph, simulated users with adversarial
+  personas, annotation queues, and what to instrument for any of it. Triggers - "agent eval", "eval suite", "LLM judge", "regression fixture",
   "trajectory eval", "checker node", "is the agent getting better", "эвалы агента",
   "оценка агента", "LLM-судья", "регрессионный набор", "как проверить агента". Not for
-  unit tests of ordinary code, or for benchmarking a model.
+  unit tests of ordinary code, or benchmarking a model.
 license: MIT
 ---
 

package/plugins/agent-stack/skills/agent-harness/references/audit.md

@@ -11,7 +11,7 @@ inherited codebase, or a "why is this unreliable" investigation.
 - Run the scanner first
 - Seven tracks
 - Evidence tiers
-- Priority, computed
+- Priority — four axes, and no scalar
 - The report
 - Traps
 
@@ -109,23 +109,56 @@ Every finding carries one, and the tier is part of the finding:
 **Never present judgement as measured.** A finding whose tier is honest survives the meeting
 where it is challenged; one that is inflated loses the whole report.
 
-## Priority, computed
+## Priority — four axes, and no scalar
 
-`P = blast × confidence / effort`
+`P = blast × confidence / effort` used to sit here, and it contradicted the two sections
+above it. "Not a score" and *pass/fail with a named failure condition beats a scalar that
+names no fix* cannot share a file with a number the plan is then ordered by.
 
-- **blast** 3 = a user of the system is harmed · 2 = the operator · 1 = a future maintainer
-- **confidence** 3 = measured · 2 = documented · 1 = judgement
-- **effort** 1 = under an hour · 2 = a session · 3 = its own project
+**And the number does not do what it claimed to do.** The section said the ranking "can be
+argued with on its inputs", but multiplication destroys them: `3 × 1 / 3` and `1 × 1 / 1`
+both print **1**, so *harms a user, judgement-tier, its own project* and *annoys a future
+maintainer, judgement-tier, an hour* arrive at one priority and nobody reading the output
+can tell which is which. A product is a one-way function on the very inputs the argument
+needs.
 
-Computed, not felt — so a dramatic finding nobody can act on ranks below a boring one that
-is fixed before lunch, and the ranking can be argued with on its inputs.
+<!-- priority-axes: impact, irreversibility, uncertainty, coordination -->
+
+So the inputs are published and the arithmetic is not. The axes are the manifesto's four
+(`~/DATA/pod-manifesto/manifesto.md:419-422`, under *these axes are not a fake numerical
+score* at `:424`), and two of them were absent here entirely while `effort` — a **cost**,
+not a risk axis — had been substituted into their place:
+
+| Axis | Question | High · Medium · Low |
+|---|---|---|
+| **Impact** | What is harmed if the finding is right? | a user of the system · the operator · a future maintainer |
+| **Irreversibility** | How hard is the harm to undo once it lands? | unrecoverable · recoverable with work · trivially reversible |
+| **Uncertainty** | How much of the behaviour cannot be checked deterministically? | unmeasurable here · measurable but unmeasured · measured |
+| **Coordination** | How many agents, repositories, services and owners meet at the fix? | many · two · one |
+
+**Ordering rule: the first axis that separates two findings decides, in that order.**
+Impact, then Irreversibility, then Uncertainty, then Coordination. It is inspectable in the
+direction the old formula was not — a reader who disagrees with the order of two findings
+can point at the axis that decided it and argue about that axis alone.
+
+**Effort keeps its job and loses its rank.** It is recorded per finding — under an hour · a
+session · its own project — and it never moves a finding up or down. It sizes the *first
+three items of the plan* so they can start immediately, which is the only decision it was
+ever good for. A cost that divides a risk is how "too expensive to fix" becomes "not
+important".
+
+**Uncertainty is not the old `confidence` renamed.** `confidence` graded the auditor's
+evidence; the axis grades what the *system* cannot be made to prove. The evidence grade
+still exists and is still required — it is the tier on every finding, one section up — and
+a finding whose tier is `judgement` says so there rather than being quietly discounted here.
 
 ## The report
 
 1. **One paragraph** — what the system is, which layer, and the single most important thing.
 2. **The scanner output**, including its blind-spot list, verbatim.
-3. **Findings by track**, each with observation, tier and priority.
-4. **The plan** — ordered by P, with the first three items sized so they can start immediately.
+3. **Findings by track**, each with observation, tier, the four axes and its effort.
+4. **The plan** — ordered by the axes above, first separating axis wins, with the first
+   three items sized by effort so they can start immediately.
 5. **What was not looked at**, and why. An audit that does not say where it stopped is read
    as complete.
 
@@ -135,7 +168,9 @@ is fixed before lunch, and the ranking can be argued with on its inputs.
   is often not in the repository at all — ask where it lives before concluding it is fine.
 - **Filing "no permission model" against a harness that delegates by design.** Check the
   layer first (`layers.md`).
-- **Grading instead of planning.** A score ends the conversation the audit was meant to start.
+- **Grading instead of planning.** A score ends the conversation the audit was meant to
+  start — including a score assembled from honest axes. Publish the axes; do not multiply
+  them.
 - **Confusing "no evals" with "not measured yet."** It is the root finding; put it first,
   because every other conclusion inherits it.
 - **Reading a silent scanner as a clean system.** It is silent about what it can see.

package/plugins/agent-stack/skills/agent-interop/SKILL.md

@@ -3,15 +3,15 @@ name: agent-interop
 description: >-
   Use when an agent must talk to something outside its own process — building or consuming an
   MCP server, exposing or calling another agent over A2A, publishing to the MCP Registry, or
-  putting a gateway in front of agent traffic. Carries the MCP 2026-07-28 wire surface and what
-  it deprecated (server/discover, stateless per-request _meta, elicitation in form and URL mode,
-  subscriptions/listen; sampling, roots, logging and dynamic client registration on the way out),
+  putting a gateway in front of agent traffic. Carries the MCP 2026-07-28 wire surface and what it
+  deprecated (server/discover, stateless per-request _meta, elicitation in form and URL mode,
+  subscriptions/listen; sampling, roots, logging and dynamic client registration going),
   A2A 1.0 agent cards, task states and three bindings, registry namespaces and server.json, tool
   federation, and what a gateway must do that an API gateway does not. Triggers - "MCP server",
   "MCP client", "A2A", "agent card", "agent interoperability", "MCP registry", "server.json",
   "agentgateway", "tool federation", "MCP-сервер", "карточка агента", "интероперабельность
-  агентов", "реестр MCP", "шлюз для агентов". Not for designing one server's tool set, and not
-  for a skill's own construction — that is make-skill.
+  агентов", "реестр MCP", "шлюз для агентов". Not for designing one server's tool set, nor for
+  a skill's own construction — that is make-skill.
 ---
 
 # Agent interop — the protocols an agent speaks outside its own process

package/plugins/agent-stack/skills/agent-orchestrator/SKILL.md

@@ -2,17 +2,16 @@
 name: agent-orchestrator
 description: >-
   Use when building an agent system — an orchestrator, an LLM-powered tool, a chatbot with tool
-  use, an AI pipeline — or when metering and billing the LLM access it burns. Covers tool-
-  calling loops, multi-stage pipelines with human checkpoints, provider routing with fallback
-  and retry, four-layer memory with confidence decay, context budgets, sub-agent coordination
-  and error hierarchies; the work as a graph — parallel layers, fake edges, a checker before
-  a convergence; for resale: tiered wallets, the single markup boundary, two-phase commit
-  across a database and a provider API, spend-delta polling, budget and loop guardrails,
-  per-tenant key lifecycle. Triggers - "agent", "orchestrator", "tool calling", "sub-agent",
-  "LLM router", "fallback chain", "human in the loop", "memory layer", "LLM billing", "token
-  wallet", "checker node", "агент", "оркестратор", "суб-агент", "роутер моделей", "человек в
-  цикле", "слой памяти", "биллинг LLM", "граф задач". Not for a single LLM call in a script,
-  or for prompt wording.
+  use, an AI pipeline — or metering and billing the LLM access it burns. Covers tool-calling
+  loops, pipelines with human checkpoints, provider routing with fallback/retry, four-layer
+  memory with confidence decay, context budgets, sub-agent coordination, error hierarchies; the
+  work as a graph — parallel layers, fake edges, a checker before convergence; for resale:
+  tiered wallets, one markup boundary, two-phase commit across database and provider API,
+  spend-delta polling, budget and loop guards, per-tenant keys. Triggers - "agent",
+  "orchestrator", "tool calling", "sub-agent", "LLM router", "fallback chain", "human in the
+  loop", "memory layer", "LLM billing", "token wallet", "checker node", "агент", "оркестратор",
+  "суб-агент", "роутер моделей", "человек в цикле", "слой памяти", "биллинг LLM", "граф задач".
+  Not for a single LLM call in a script, or prompt wording.
 ---
 
 # Agent Orchestrator — Production Best Practices