kenaz 0.3.18 → 0.3.20

package/core/.rule/general/sunny-access-control.yaml

@@ -1,60 +0,0 @@
-# .rule/general/sunny-access-control.yaml
-# SEC-010: Sunny 系統存取控制
-
-_meta:
-  category: "general"
-  priority: 0
-  applies_to:
-    - "ai_agent"
-  created_at: "2026-02-15"
-  rationale: |
-    Sunny 是內部系統開發 Agent，擁有繞過 CLAUDE.md 的特權。
-    必須限制其他 Agent 存取 Sunny 的工具、規則和配置，避免特權擴散。
-
-rules:
-  - id: "SEC-010"
-    title: "Sunny 系統存取控制"
-    description: |
-      只有透過 /sunny 指令啟動的 session 才能存取 Sunny 系統。
-      其他 Agent 禁止讀取、修改或調用 Sunny 的任何資源。
-    severity: "must"
-
-    protected_paths:
-      - ".system/sunny/"
-      - ".claude/skills/sunny/"
-
-    forbidden_actions:
-      - action: "讀取 .system/sunny/ 下的任何檔案"
-        applies_to: ["product_manager", "developer", "designer", "backend_engineer", "qa_engineer", "sre_agent", "dev_agent", "assessment_agent", "feature_agent", "frontend_agent", "optimization_agent", "team_worker"]
-
-      - action: "修改 .system/sunny/ 下的任何檔案"
-        applies_to: ["all_agents_except_sunny"]
-
-      - action: "調用 /sunny 指令或引用 Sunny 的工具"
-        applies_to: ["all_agents_except_sunny"]
-
-      - action: "在 Task subagent 中使用 Sunny 的配置或規則"
-        applies_to: ["all_agents_except_sunny"]
-
-    allowed:
-      - agent: "sunny"
-        permissions: ["read", "write", "execute"]
-        note: "Sunny 自身擁有完整存取權限"
-
-      - agent: "human_developer"
-        permissions: ["read", "write"]
-        note: "人類開發者可直接管理 Sunny 配置"
-
-    enforcement:
-      - "Agent 啟動時檢查自身身份，非 Sunny 不得載入 .system/sunny/*"
-      - "Task subagent 不得傳遞 Sunny 的配置內容"
-      - "Team Worker 不得引用 Sunny 的 tools.json 或 RULES.json"
-
-    examples:
-      violations:
-        - "product_manager 讀取 .system/sunny/RULES.json 以獲取特權"
-        - "dev_agent 調用 Sunny 的 team-launcher 工具"
-        - "team_worker 引用 Sunny 的 cortex 配置繞過標準流程"
-      correct:
-        - "用戶直接輸入 /sunny 啟動 Sunny 模式"
-        - "人類開發者手動編輯 .system/sunny/RULES.json"

package/core/.rule/general/system-invariants.yaml

@@ -1,231 +0,0 @@
-# .rule/general/system-invariants.yaml
-# SYS-INV: KenazAI System Invariants Catalog (Conservation Laws)
-#
-# PURPOSE
-#   This file is an INDEX of system-level invariants — conservation laws, caps,
-#   and bounds that the KenazAI system is designed to preserve. Ansuz Phase 2
-#   (research) queries this catalog BEFORE diving into case research, because
-#   strategy often falls straight out of the bounds (see VC33: T+M+B
-#   conservation → alternating-pump strategy without trial).
-#
-# DISCIPLINE
-#   - This file is an INDEX, NOT a source of truth.
-#   - Every entry MUST cite a `source:` back to the defining file+section.
-#   - Never duplicate a definition here. Paraphrase bound, link to source.
-#   - Update the `source:` reference when the defining file moves/renames.
-#
-# USAGE
-#   Ansuz Phase 2: scan invariants relevant to the task's scope → derive
-#   constraints → check if strategy is already implied by the bound before
-#   researching past cases.
-
-_meta:
-  id: "SYS-INV"
-  version: "1.0.0"
-  description: "KenazAI system invariants — conservation laws, caps, bounds"
-  last_updated: "2026-04-05"
-  created_from: "TASK_1023"
-  file_type: "index"  # NOT source-of-truth
-  discipline: |
-    Single source of truth. This file indexes but never defines. Every
-    invariant MUST link back via source: path#section.
-
-# ============================================================================
-# CATEGORY: task_system
-# Task lifecycle, state conservation, FSM transitions
-# ============================================================================
-
-invariants:
-
-  - name: task_status_totality
-    category: task_system
-    formula: |
-      tasks_total = |backlog| + |active| + |done| + |blocked| + |cancel| + |archived| + |pool|
-      (every task belongs to exactly one status directory — no orphans,
-       no duplicates across directories)
-    bound: "status ∈ {backlog, active, done, blocked, cancel, archived, pool}"
-    enforcement: |
-      task-api.js moveTask() atomic copy-then-delete; ALL_STATUS_DIRS
-      enumerates the closed set of valid status directories.
-    violation_detection: |
-      Scan all STATUS_DIRS for duplicate task_ids → if same id appears in
-      two directories, atomicity broke. See FAIL-003 (queue pollution).
-    source: ".collaboration/core/task-api.js#L95-L97 (STATUS_DIRS, ALL_STATUS_DIRS)"
-    failure_witness: ".failure/pipeline/FAIL-003-queue-pollution.yaml"
-
-  - name: task_state_transitions_fsm
-    category: task_system
-    formula: |
-      VALID_TRANSITIONS = {
-        backlog  → {active, cancel, blocked},
-        active   → {done, blocked, cancel, backlog},
-        blocked  → {active, backlog, cancel},
-        done     → {backlog, archived},
-        cancel   → {backlog},
-        archived → {backlog}
-      }
-    bound: "FSM — NOT strictly single-directional; reopen edges exist"
-    enforcement: |
-      task-api.js moveTask() validates newStatus against VALID_TRANSITIONS
-      before performing the move.
-    violation_detection: |
-      task-api.js moveTask rejects invalid transitions with an explicit
-      error. Audit log of moves can be replayed against the FSM.
-    source: ".collaboration/core/task-api.js#L119-L125 (VALID_TRANSITIONS)"
-
-  - name: completed_task_archival_discipline
-    category: task_system
-    formula: "done tasks must be archived; never re-enter active pool as 'completed'"
-    bound: "|{t ∈ TASK_QUEUE | t.status == completed}| = 0 after archival"
-    enforcement: |
-      PPL-002 (pipeline/PPL-002-completed-task-archival.yaml) — scheduler
-      must archive-then-remove, not mark-completed-in-place.
-    violation_detection: |
-      Grep TASK_QUEUE.json for status:completed entries; non-empty ⇒ leak.
-    source: ".rule/pipeline/PPL-002-completed-task-archival.yaml"
-    failure_witness: ".failure/pipeline/FAIL-003-queue-pollution.yaml"
-
-# ============================================================================
-# CATEGORY: concurrency
-# Parallel execution caps, locks, isolation boundaries
-# ============================================================================
-
-  - name: worktree_isolation_boundary
-    category: concurrency
-    formula: |
-      ∀ dispatched_task t: t.cwd = .formation/worktrees/task_<id>/
-      (all Read/Edit/Write MUST use worktree-absolute paths, NOT main
-       repo paths)
-    bound: "one worktree per active dispatch; no cross-worktree writes"
-    enforcement: |
-      Agent-tool dispatch carries SUBAGENT_PREFIX rule 11 (WORKTREE FILE
-      PATH RULE) in prompt.js. (The former runner.js spawn-time "[WORKTREE]"
-      injection was removed with the headless path, TASK_2401.)
-    violation_detection: |
-      Agent Edits a path under main repo root while cwd is a worktree →
-      `git add -A` in worktree finds no changes. See FAIL-013.
-    source: ".formation/tools/prompt.js SUBAGENT_PREFIX rule 11"
-    failure_witness: ".failure/agent-execution/FAIL-013-search-cwd-drift-and-case-mismatch.yaml"
-
-  - name: per_project_dispatch_lock
-    category: concurrency
-    formula: "per-project dispatch-lock serializes non-worktree dispatches"
-    bound: "1 in-flight serial dispatch per project at a time"
-    enforcement: |
-      Dispatch-lock fallback in dispatch.js (tryAcquireDispatchLock) — when a
-      worktree is unavailable or the task is unsuitable for one, fall back
-      to the per-project serial lock.
-    violation_detection: |
-      Two concurrent non-worktree dispatches writing the same project
-      state (e.g., task-api moves). Lock contention visible in logs.
-    source: ".formation/tools/dispatch.js (tryAcquireDispatchLock) + .formation/tools/utils.js (dispatchLockPath)"
-
-# ============================================================================
-# CATEGORY: cognitive
-# Fatigue/engagement potentials, phase token budgets, context bounds
-# ============================================================================
-
-  - name: fatigue_potential_upper_bound
-    category: cognitive
-    formula: "fatigue_potential ∈ [0.0, 1.0]"
-    bound: "≤ 1.0 (saturation ceiling)"
-    enforcement: |
-      fatigue_potential is clamped to [0,1]; Ansuz kernel
-      reads this as a float in handoff JSON and formats as {:.1f}. When
-      fatigue_potential == 1.0, Ansuz triggers session handoff (kernel
-      Phase 12 exit ritual).
-    violation_detection: |
-      Any fatigue_potential > 1.0 in a per-session handoff slot
-      (.kenaz/specialist/handoffs/<sessionId>.json; legacy singular
-      ansuz_session_handoff.json retired by M3/TASK_1760) is a
-      clamp-bug. Handoff never triggered on 0.9 ⇒ threshold bug.
-    source: "dev/archive/ansuz/legacy/kernel.yaml#L213,L350,L381 (fatigue_potential ≤ 1)"
-
-  - name: engagement_potential_upper_bound
-    category: cognitive
-    formula: "engagement_potential ∈ [0.0, 1.0]"
-    bound: "≤ 1.0 (saturation ceiling, mirror of fatigue)"
-    enforcement: |
-      engagement_potential follows the same 0.0-1.0 clamp convention as
-      fatigue_potential (the Muninn observer that produced it was retired
-      2026-10-07, TASK_2345; legacy values in handoff slots keep the bound).
-    violation_detection: |
-      Engagement score > 1.0 in a handoff slot indicates an unnormalized sum.
-    source: "dev/archive/ansuz/legacy/kernel.yaml#L213,L350,L381 (same clamp convention as fatigue_potential)"
-
-  - name: phase_0_token_budget
-    category: cognitive
-    formula: "Ansuz Phase 0 banner context ≤ 500 tokens"
-    bound: "≤ 500 tokens (soft cap; boot injection budget)"
-    enforcement: |
-      Phase 0 banner is constrained so awakening doesn't burn the context
-      budget before work begins (the Norn preamble tool was removed in TASK_2335).
-    violation_detection: |
-      Count tokens of Phase 0 output; > 500 ⇒ banner bloat.
-    source: "CLAUDE.md#Session 初始化 (Phase 0 boot budget)"
-
-  - name: cap_first_debug_discipline
-    category: cognitive
-    formula: |
-      When a system action blocks/stalls/fails unexpectedly, enumerate
-      known caps BEFORE debugging: {max_parallel=5, fatigue_potential≤1,
-      context budget, dispatch lock, hippocampus budget}. Caps are
-      strategy-constraints, not bugs.
-    bound: "N/A (procedural invariant — debugging discipline)"
-    enforcement: |
-      Ansuz kernel evolvable rule CAP-FIRST-DEBUG (VC33 derivation).
-    violation_detection: |
-      Debug session burns hours on a symptom that a 30-second cap check
-      would have explained (VC33: cursor stuck at col 20 = mid-wall cap,
-      not click failure).
-    source: "dev/archive/ansuz/legacy/kernel.yaml#L213 (CAP-FIRST-DEBUG)"
-
-# ============================================================================
-# CATEGORY: memory
-# Persistence intervals, retention, single-slot semantics
-# ============================================================================
-
-  - name: ansuz_session_handoff_slot_per_session
-    category: memory
-    formula: |
-      ∃ at-most-one active handoff PER SESSION:
-      {PROJECT_PATH}/.kenaz/specialist/handoffs/<sessionId>.json
-      Multiple slots (one per session) coexist BY DESIGN — M3 migration
-      (TASK_1760) replaced the retired singular slot
-      ansuz_session_handoff.json, which is read-only legacy fallback.
-    bound: "one slot per session; legacy singular slot write-forbidden"
-    enforcement: |
-      All handoff IO goes through handoff-resolver.js (TASK_1829):
-      writeHandoff targets only the per-session slot (atomic
-      write-.tmp-and-rename); readOwnHandoff / readLatestHandoff are the
-      only two read semantics (own-session freshness vs. boot-time
-      latest) and must never be merged. Archive-before-overwrite guard:
-      ansuz-handoff-snapshot.js archives a different session's slot
-      content to Hippocampus before overwrite; 30-min freshness window
-      prevents auto-snapshot clobbering a live author.
-    violation_detection: |
-      Any code path WRITING the legacy singular slot ⇒ violation
-      (grep -rn ansuz_session_handoff; only resolver-internal read
-      fallbacks and marked-historical references may remain). Multiple
-      slots under handoffs/ is NOT a violation. Unread handoff
-      overwritten without Hippocampus archive episode ⇒ guard bypassed.
-    source: ".specialist/Ansuz/tools/handoff-resolver.js (TASK_1829); .specialist/Ansuz/tools/ansuz-handoff-snapshot.js (freshness + archive guard)"
-
-# ============================================================================
-# Maintenance notes
-# ============================================================================
-_maintenance:
-  when_to_update: |
-    - A new cap/bound is introduced in source files (e.g., new max_*
-      constant, new FSM transition, new retention window).
-    - An existing bound is changed (value, scope, or enforcement path).
-    - A new failure case demonstrates an invariant was not previously
-      catalogued.
-  when_to_remove: |
-    - The underlying source file removes the bound entirely.
-    - Two entries describe the same invariant (dedupe — keep the entry
-      with the more precise source: reference).
-  cross_references:
-    - ".rule/INDEX.yaml (rule system index)"
-    - ".failure/INDEX.yaml (failure witness ground truth)"
-    - "dev/archive/ansuz/legacy/kernel.yaml (CAP-FIRST-DEBUG consumer)"