kenaz 0.3.5 → 0.3.6

package/core/.specialist/Ansuz/tools/verify-and-land.js

@@ -147,6 +147,8 @@ function buildPlan(config) {
     plan.push({ name: 'negative-control', kind: 'neg' });
   }
   if (!config.noMerge) {
+    // TASK_2400: ARCH-001 file-size gate, cheap and deterministic, so before the heavy checks.
+    plan.push({ name: 'file-size', kind: 'file-size' });
     // TASK_2176: the authoritative, serialized heavyweight check runs right
     // before merge, on the main tree (config.repo) -- gates the merge that
     // follows it, same as the worktree-side negative control gates it above.
@@ -759,6 +761,24 @@ function coreToolPath(config, rel) {
   return path.join(__dirname, '..', '..', '..', rel);
 }
 
+/**
+ * TASK_2400: ARCH-001 gate. Runs the core's check-file-size.js on branch vs merge-base
+ * (--repo = the project, so a user project uses its own .rule yaml or the built-in
+ * defaults). BLOCK -> step fails, merge never runs; WARN lines go into the step summary.
+ */
+function stepFileSize(config, deps, ctx) {
+  const script = coreToolPath(config, path.join('dev', 'scripts', 'check-file-size.js'));
+  if (!fs.existsSync(script)) return { ok: true, summary: 'check-file-size.js not found in core, skipped', log: '' };
+  const base = git(deps, config.repo, ['merge-base', 'HEAD', ctx.branch]);
+  const res = deps.spawnSync('node', [script, '--base', base, '--head', ctx.branch, '--repo', config.repo], { encoding: 'utf8' });
+  const output = (res.stdout || '') + (res.stderr || '');
+  const found = output.split('\n').filter((l) => /ARCH-001 (BLOCK|WARN)/.test(l)).map((l) => l.trim());
+  if (res.status === 0) {
+    return { ok: true, summary: found.length ? `${found.length} warning(s): ${found.join(' | ')}`.slice(0, 600) : 'within thresholds', log: output };
+  }
+  return { ok: false, summary: `ARCH-001 blocked (exit ${res.status}): ${found.join(' | ') || output.trim()}`.slice(0, 800), log: output };
+}
+
 function writeLandingInfo(config, deps, ctx) {
   if (!ctx || !ctx.postMergeHead) return; // no merge landed (--no-merge etc.) -- nothing to record
   const shortSha = ctx.postMergeHead.slice(0, 8);
@@ -845,6 +865,7 @@ async function executeStep(stepDef, config, deps, ctx) {
     case 'rust': return stepRust(config, deps, ctx, stepDef.filter);
     case 'node': return stepNode(config, deps, ctx, stepDef.file);
     case 'neg': return stepNegativeControl(config, deps, ctx);
+    case 'file-size': return stepFileSize(config, deps, ctx);
     case 'verify-offline': return stepVerifyOffline(config, deps);
     case 'merge': return stepMerge(config, deps, ctx);
     case 'task-complete': return stepTaskComplete(config, deps, ctx);
@@ -1000,6 +1021,7 @@ module.exports = {
   latestStartedAtAfter,
   resolveRepoFromWorktree,
   coreToolPath,
+  stepFileSize,
   assertRepoOwnsWorktree,
   resolveRepo,
   UsageError,

package/core/.specialist/Ansuz/tools/verify-and-land.test.js

@@ -33,6 +33,7 @@ const {
   DEFAULT_RUST_MAX_S,
   resolveVerifyOfflineCmd,
   stepVerifyOffline,
+  stepFileSize,
 } = require('./verify-and-land.js');
 
 // Same shared list verify-and-land.js reads (TASK_2069) — tests assert
@@ -273,6 +274,7 @@ test('buildPlan: fixed step order for a full config (default warm route — no c
     'rust:foo',
     'node:t.js',
     'negative-control',
+    'file-size',
     'merge',
     'task-complete',
     'mark-landed',
@@ -362,6 +364,8 @@ test('success path: runs steps in order (rust via the warm rust-verify-worktree.
         return ok('test result: ok. 5 passed; 0 failed\n');
       }
       if (cmd === 'node' && args[0] === '--test') return ok('ℹ pass 2\nℹ fail 0\n');
+      if (cmd === 'git' && args[2] === 'merge-base' && args[3] === 'HEAD') return ok('basesha\n');
+      if (cmd === 'node' && args[0].includes('check-file-size.js')) return ok('');
       if (cmd === 'git' && args[2] === 'merge' && args.includes('--no-ff')) {
         mergeCount++;
         return ok('Merge made by the recursive strategy.\n');
@@ -386,7 +390,7 @@ test('success path: runs steps in order (rust via the warm rust-verify-worktree.
   // copies its own resources into the fixed verify worktree.
   assert.deepEqual(
     result.steps.map(s => s.name),
-    ['preflight', 'rust:foo', 'node:test/a.test.js', 'merge', 'task-complete', 'mark-landed']
+    ['preflight', 'rust:foo', 'node:test/a.test.js', 'file-size', 'merge', 'task-complete', 'mark-landed']
   );
   assert.ok(result.steps.every(s => s.ok === true));
   assert.equal(mergeCount, 1, 'merge must run exactly once');
@@ -416,6 +420,8 @@ test('TASK_2142 R2: task-complete bakes landed commit sha + verification summary
       if (cmd === 'git' && args[2] === 'status') return ok('');
       if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
       if (cmd === 'node' && args[0].includes('rust-verify-worktree.js') && args[1] === 'run') return ok('test result: ok. 3 passed; 0 failed\n');
+      if (cmd === 'git' && args[2] === 'merge-base' && args[3] === 'HEAD') return ok('basesha\n');
+      if (cmd === 'node' && args[0].includes('check-file-size.js')) return ok('');
       if (cmd === 'git' && args[2] === 'merge' && args.includes('--no-ff')) return ok('Merge made by the recursive strategy.\n');
       if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === 'HEAD') {
         headCount++;
@@ -772,7 +778,7 @@ test('dry-run: resolves/validates --repo via read-only git (same guard as a real
   assert.equal(result.repo, config.repo, 'dry-run output includes the resolved repo path');
   assert.deepEqual(
     result.steps.map(s => s.name),
-    ['preflight', 'rust:foo', 'node:t.js', 'negative-control', 'merge', 'task-complete', 'mark-landed', 'wait-backend', 'live']
+    ['preflight', 'rust:foo', 'node:t.js', 'negative-control', 'file-size', 'merge', 'task-complete', 'mark-landed', 'wait-backend', 'live']
   );
   assert.ok(result.steps.every(s => s.planned === true));
 });
@@ -923,6 +929,8 @@ test('merge verification: "Already up to date" (unchanged HEAD) fails the merge
       if (cmd === 'git' && args[2] === 'status') return ok('');
       if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
       if (cmd === 'node' && args[0].includes('rust-verify-worktree.js') && args[1] === 'run') return ok('test result: ok. 1 passed; 0 failed\n');
+      if (cmd === 'git' && args[2] === 'merge-base' && args[3] === 'HEAD') return ok('basesha\n');
+      if (cmd === 'node' && args[0].includes('check-file-size.js')) return ok('');
       if (cmd === 'git' && args[2] === 'merge' && args.includes('--no-ff')) return ok('Already up to date.\n');
       // HEAD is the SAME before and after — this is the exact bug that shipped.
       if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === 'HEAD') return ok('deadbeef\n');
@@ -934,7 +942,7 @@ test('merge verification: "Already up to date" (unchanged HEAD) fails the merge
   const result = await runVerifyAndLand(config, deps);
   assert.equal(result.ok, false);
   assert.equal(result.failed_step, 'merge');
-  assert.deepEqual(result.steps.map(s => s.name), ['preflight', 'rust:foo', 'merge']);
+  assert.deepEqual(result.steps.map(s => s.name), ['preflight', 'rust:foo', 'file-size', 'merge']);
   assert.match(result.steps[result.steps.length - 1].summary, /unchanged|did not land/);
   assert.equal(taskCompleteCalled, false, 'task-api complete must never run after a merge that did not actually land');
 });
@@ -958,7 +966,7 @@ test('resolveVerifyOfflineCmd: project.yaml without the key -> null', () => {
 
 test('buildPlan: verify-offline step is included only when verifyOfflineCmd is set, placed right before merge', () => {
   const withCmd = buildPlan(baseConfig({ verifyOfflineCmd: 'node fake-unity.js' }));
-  assert.deepEqual(withCmd.map(s => s.name), ['preflight', 'verify-offline', 'merge', 'task-complete', 'mark-landed']);
+  assert.deepEqual(withCmd.map(s => s.name), ['preflight', 'file-size', 'verify-offline', 'merge', 'task-complete', 'mark-landed']);
   const withoutCmd = buildPlan(baseConfig({ verifyOfflineCmd: null }));
   assert.ok(!withoutCmd.some(s => s.kind === 'verify-offline'), 'no key in project.yaml -> no step, unaffected');
 });
@@ -1028,6 +1036,8 @@ test('runVerifyAndLand: verify_offline failure blocks landing (full pipeline, re
       if (cmd === 'git' && args[2] === 'status') return ok('');
       if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
       if (cmd === 'node fake-unity.js --break') return bad(1, '', 'compile error'); // shell:true -- cmd is the whole command string, args is []
+      if (cmd === 'git' && args[2] === 'merge-base' && args[3] === 'HEAD') return ok('basesha\n');
+      if (cmd === 'node' && args[0].includes('check-file-size.js')) return ok('');
       if (cmd === 'git' && args[2] === 'merge') { mergeCalled = true; return ok('merged\n'); }
       throw new Error('unexpected spawnSync in verify_offline-blocks-landing test: ' + JSON.stringify({ cmd, args }));
     },
@@ -1035,7 +1045,7 @@ test('runVerifyAndLand: verify_offline failure blocks landing (full pipeline, re
   const result = await runVerifyAndLand(config, deps);
   assert.equal(result.ok, false);
   assert.equal(result.failed_step, 'verify-offline');
-  assert.deepEqual(result.steps.map(s => s.name), ['preflight', 'verify-offline']);
+  assert.deepEqual(result.steps.map(s => s.name), ['preflight', 'file-size', 'verify-offline']);
   assert.equal(mergeCalled, false, 'verify_offline failure must block the merge that follows it');
 });
 
@@ -1097,3 +1107,47 @@ test('coreToolPath: a sub-project repo (only .kenaz/) resolves core tools via pr
     fs.rmSync(tmp, { recursive: true, force: true });
   }
 });
+
+// ── TASK_2400: ARCH-001 file-size gate (real temp repo, real check-file-size.js) ──
+
+function makeSizeFixture(extraFiles) {
+  const fsr = require('node:fs');
+  const os = require('node:os');
+  const repo = fsr.mkdtempSync(path.join(os.tmpdir(), 'size-gate-'));
+  const run = (...a) => { const r = realSpawnSync('git', ['-C', repo, ...a], { encoding: 'utf8' }); assert.equal(r.status, 0, r.stderr); return r.stdout; };
+  const body = n => Array.from({ length: n }, (_, i) => `const v${i} = ${i};`).join('\n') + '\n';
+  run('init', '-q', '-b', 'main');
+  run('config', 'user.email', 't@t'); run('config', 'user.name', 't');
+  fsr.writeFileSync(path.join(repo, 'big.js'), body(2100)); // over the 2000 hard limit: grandfathered debt
+  run('add', '-A'); run('commit', '-q', '-m', 'base');
+  run('checkout', '-q', '-b', 'task');
+  fsr.writeFileSync(path.join(repo, 'big.js'), body(2200)); // +100 lines
+  for (const [name, n] of Object.entries(extraFiles || {})) fsr.writeFileSync(path.join(repo, name), body(n));
+  run('add', '-A'); run('commit', '-q', '-m', 'grow');
+  run('checkout', '-q', 'main');
+  return { repo, cleanup: () => fsr.rmSync(repo, { recursive: true, force: true }) };
+}
+
+test('stepFileSize: growing an over-limit file without an extraction is refused (BLOCK)', () => {
+  const fx = makeSizeFixture();
+  try {
+    const res = stepFileSize({ repo: fx.repo }, { spawnSync: realSpawnSync }, { branch: 'task' });
+    assert.equal(res.ok, false);
+    assert.match(res.summary, /ARCH-001 blocked/);
+    assert.match(res.summary, /big\.js/);
+  } finally { fx.cleanup(); }
+});
+
+test('stepFileSize: same growth paired with a new extracted module passes', () => {
+  const fx = makeSizeFixture({ 'extracted.js': 60 });
+  try {
+    const res = stepFileSize({ repo: fx.repo }, { spawnSync: realSpawnSync }, { branch: 'task' });
+    assert.equal(res.ok, true, res.summary);
+  } finally { fx.cleanup(); }
+});
+
+test('buildPlan: file-size runs before merge, and not at all with --no-merge', () => {
+  const names = buildPlan(baseConfig({})).map(s => s.name);
+  assert.deepEqual(names, ['preflight', 'file-size', 'merge', 'task-complete', 'mark-landed']);
+  assert.ok(!buildPlan(baseConfig({ noMerge: true })).some(s => s.name === 'file-size'));
+});

package/core/.specialist/Ansuz/workflow.yaml

@@ -94,7 +94,7 @@ phase_0_initialization:
       1. 檢查當前工作目錄（cwd）是否有 .kenaz/project.yaml
       2. 如果有 → 子專案模式：設定 PROJECT_PATH = cwd, CORE = project.yaml 的 core_path
       3. 如果沒有 → Core 模式：PROJECT_PATH 為空，不需要 --project-path
-      4. 後續所有 task-api.js / headless.js / post-complete.js 呼叫都根據此結果決定是否加 --project-path
+      4. 後續所有 task-api.js / dispatch.js / post-complete.js 呼叫都根據此結果決定是否加 --project-path
     check: |
       # 子專案偵測（在 cwd 執行）
       if [ -f .kenaz/project.yaml ]; then
@@ -753,19 +753,15 @@ phase_8_dispatch:
 
   # ─── Dispatch 執行 ───
   execution:
-    tool: ".formation/tools/headless.js"
-    method: "Bash tool → node headless.js → 啟動獨立 claude CLI 進程"
-    max_parallel: 5
+    tool: ".formation/tools/dispatch.js"
+    method: "Bash tool → node dispatch.js --dispatch-mode=subagent → 取回 promptText + agentParams → Agent tool 開 subagent"
     patterns:
-      single: "一個任務 → Bash(run_in_background=true): node headless.js --task=TASK_XXX [--project-path ...]"
-      parallel: "多個無依賴 → 多個 Bash(background) 同時啟動（上限 5，超過排隊）"
+      single: "一個任務 → node dispatch.js --task=TASK_XXX --dispatch-mode=subagent [--project-path ...] → Agent tool"
       sequential: "有依賴 → 前一個完成再 dispatch 下一個"
     cli:
-      unit: "node {CORE}/.formation/tools/headless.js --skill=do --task=TASK_XXX [--project-path {PROJECT_PATH}]"
-      solo: "node {CORE}/.formation/tools/headless.js --formation=solo --skill=strategy --task=TASK_XXX [--project-path {PROJECT_PATH}]"
-      squad: "node {CORE}/.formation/tools/headless.js --formation=squad --skill=blitz --task=TASK_XXX [--project-path {PROJECT_PATH}]"
-      legion: "node {CORE}/.formation/tools/headless.js --formation=legion --skill=forge --task=TASK_XXX [--project-path {PROJECT_PATH}]"
-    anti_pattern: "❌ 禁止用 Task tool 直接開 subagent — 繞過 Formation 會失去 prompt 組裝、principles 注入和 log"
+      unit: "node {CORE}/.formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent [--project-path {PROJECT_PATH}]"
+      solo: "node {CORE}/.formation/tools/dispatch.js --formation=solo --skill=strategy --task=TASK_XXX --dispatch-mode=subagent [--project-path {PROJECT_PATH}]"
+    anti_pattern: "❌ 不手寫 subagent prompt — 用 dispatch.js 組裝（prompt 組裝、principles 注入）"
 
   # ─── Scope 安全 ───
   scope:

package/core/.specialist/Forseti/core.yaml

@@ -162,7 +162,7 @@ degradation:
 # ═══════════════════════════════════════
 invocation:
   via_formation:
-    command: "node .formation/tools/headless.js --skill=do --task={FORSETI_TASK_ID} --project-path={path}"
+    command: "node .formation/tools/dispatch.js --skill=do --task={FORSETI_TASK_ID} --project-path={path} --dispatch-mode=subagent"
     context_required:
       - "task_id: 被驗證的 Dev Task ID（必填）"
       - "project_path: /absolute/path/to/project（必填）"

package/core/.specialist/Heimdall/SKILL.md

@@ -49,7 +49,7 @@ post_complete_verdict: RECORDED | delta: {N.NN|n/a} | reason: {text}
 | 項目 | 說明 |
 |------|------|
 | 路徑 | `.kenaz/health_snapshots/{taskId}_before.json` / `_after.json` |
-| 寫入者 | `headless.js`（dispatch 時）或首次運行時由 post-complete.js 寫入 |
+| 寫入者 | 首次運行時由 post-complete.js 寫入 |
 | 格式 | `{ "score": 82, "grade": "B", "timestamp": "..." }` |
 | 無快照時 | 保存當前分數為基線 |
 

package/core/.specialist/Heimdall/core.yaml

@@ -211,7 +211,7 @@ workflow:
       - "✅ Always write post_complete_verdict: RECORDED to the task YAML when a post-task score exists"
     pre_task_snapshot:
       description: "Health baseline captured before Formation dispatch"
-      written_by: "headless.js at task dispatch time (or post-complete.js as fallback)"
+      written_by: "post-complete.js (first run when no baseline exists)"
       path: ".kenaz/health_snapshots/{task_id}_before.json"
       schema: "{ score: number, grade: string, timestamp: ISO-8601 }"
 
@@ -233,7 +233,7 @@ degradation:
 # ═══════════════════════════════════════
 invocation:
   via_formation:
-    command: "node .formation/tools/headless.js --skill=do --task=HEIMDALL_SCAN --project-path={path}"
+    command: "node .formation/tools/dispatch.js --skill=do --task=HEIMDALL_SCAN --project-path={path} --dispatch-mode=subagent"
     context_required:
       - "trigger: attention | commit | scheduled | manual"
       - "project_path: /absolute/path/to/project"

package/core/.specialist/Huginn/rule.yaml

@@ -50,7 +50,7 @@ deny:
   - "寫程式碼或修改 src/ 下任何檔案"
   - "修改其他 specialist 的檔案"
   - "建立 .collaboration/tasks/（那是 Ansuz 的事）"
-  - "使用 .formation/tools/headless.js 調度任何任務"
+  - "使用 .formation/tools/dispatch.js --dispatch-mode=subagent 調度任何任務"
   - "呼叫 hippocampus_episode_start/append/close"
   - "修改 .rule/ 下任何規則（安全邊界 — Huginn 不能改自己的規則）"
   - "建立 proposal（Prefrontal 提案系統已移除 — 只寫 huginn_advisory.jsonl）"

package/core/.specialist/tools/README.md

@@ -19,7 +19,7 @@
 
 | 模式 | 說明 | 用途 |
 |------|------|------|
-| **assembled**（預設） | 將所有 YAML 內容內嵌到 prompt | headless.js、API、Dashboard |
+| **assembled**（預設） | 將所有 YAML 內容內嵌到 prompt | dispatch.js、API、Dashboard |
 | **reference** | 回傳檔案讀取指令（同 slash command） | Claude Code 內互動 |
 
 ### CLI 用法
@@ -79,7 +79,7 @@ const active = session.getActiveSessions();
 
 ### 整合範例
 
-**Formation headless.js**:
+**Formation dispatch.js**:
 ```js
 const { buildPrompt } = require('../.specialist/tools/session');
 const prompt = buildPrompt('Ansuz', { task: taskData, mode: 'assembled' });

package/core/.system/collaboration/README.md

@@ -156,7 +156,7 @@ node .collaboration/core/task-api.js move TASK_194 blocked --force
 `project_name`）；需要更精確的來源（例如具體的 in-app agent 名稱）可用 `--origin <name>` 覆寫。
 
 **不是 auto-pipeline**：`createTask()` 一律寫入 `backlog/`（`pending` 狀態），走正常 triage 流程 ——
-`submit` 完全不呼叫 dispatch/headless.js，不會自動執行任務。來源內容（title/description 等）視為未信任資料，
+`submit` 完全不呼叫 dispatch.js，不會自動執行任務。來源內容（title/description 等）視為未信任資料，
 與 field report 相同處理方式（寫入前不會被當作指令執行）。
 
 **為什麼不是 HTTP server**：呼叫方本身就是一個能 spawn `node`/`k-cli` 的本地 process；開一個 HTTP server

package/core/.system/formation/LEGACY_SKILLS.md

@@ -1,5 +1,7 @@
 # Formation Legacy Skills - 全角色定義
 
+> **[RETIRED 2026-10, TASK_2401/2402/2403]** 本文描述已退役的 headless / legacy-scheduler Formation，僅留作歷史參考。現行路徑：`node .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent`（見 `.formation/README.md`）。
+
 > **專案位置**: `.formation/legacy/`
 > **系統類型**: Formation Legacy 陣型專用 Skills
 > **適用場景**: Legacy Scheduler 自動調度、Formation Lead 任務分派

package/core/.system/formation/POST_COMPLETE.md

@@ -1,5 +1,7 @@
 # Formation Post-Complete - 任務完成後自動化
 
+> **[RETIRED CALLERS 2026-10, TASK_2401/2402/2403]** 文中的 legacy-scheduler.js / headless.js 呼叫端已移除，僅留作歷史參考；post-complete.js 本身仍存在。現行派工：`node .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent`。
+
 > **專案位置**: `.formation/tools/post-complete.js`
 > **系統類型**: Formation Lead 專用工具
 > **適用場景**: 任務完成後的自動 Archive + Git 分支管理

package/core/.system/formation/README.md

@@ -1,5 +1,7 @@
 # Formation System - 多陣型調度系統
 
+> **[RETIRED 2026-10, TASK_2401/2402/2403]** 本文描述已退役的 headless / legacy-scheduler Formation，僅留作歷史參考。現行路徑：`node .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent`（見 `.formation/README.md`）。
+
 > **專案位置**: `.formation/`
 > **系統類型**: Multi-Agent 協作陣型系統
 > **適用場景**: 根據任務規模動態選擇最佳 Agent 部署策略

package/core/KENAZ_CORE_VERSION

@@ -1 +1 @@
-0.3.5
+0.3.6

package/core/dev/scripts/check-file-size.js

@@ -4,7 +4,9 @@
  * ARCH-001 deterministic delta-aware file-size gate.
  *
  * Single source of truth for thresholds/scope: .rule/general/file-size-threshold.yaml
- * (this script never hardcodes 2000/4000 or the include/exclude globs).
+ * (project copy first, then core's; DEFAULT_CONFIG below when neither exists, e.g. a user
+ * project). Thresholds 2026-10-10: warn 1000 / hard 2000; existing over-limit files are
+ * grandfathered (only growth without a paired extraction blocks).
  *
  * Delta-aware + grandfather semantics:
  *   - BLOCK: a change newly pushes a file past hard_limit, OR grows a file
@@ -30,7 +32,6 @@ const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
 const yaml = (() => { try { return require('js-yaml'); } catch { return require('../../.vendor/js-yaml.cjs'); } })();
-const micromatch = require('micromatch');
 
 const ROOT = path.resolve(__dirname, '..', '..');
 const RULE_PATH = path.join(ROOT, '.rule', 'general', 'file-size-threshold.yaml');
@@ -40,17 +41,28 @@ const RULE_PATH = path.join(ROOT, '.rule', 'general', 'file-size-threshold.yaml'
 // define this separately for warn vs hard_limit, so both cases share it.
 const GROWTH_THRESHOLD_LOC = 50;
 
-function loadConfig() {
-  let raw;
-  try {
-    raw = fs.readFileSync(RULE_PATH, 'utf8');
-  } catch (e) {
-    throw new Error(`ARCH-001: cannot read rule source ${RULE_PATH}: ${e.message}`);
-  }
-  const doc = yaml.load(raw);
+// Built-in defaults, used when neither the project nor the core has the rule yaml
+// (a user project installed from npm). Keep in sync with the yaml.
+const DEFAULT_CONFIG = {
+  warn: 1000,
+  hardLimit: 2000,
+  include: ['**/*.rs', '**/*.ts', '**/*.tsx', '**/*.js', '**/*.jsx', '**/*.py', '**/*.go'],
+  exclude: [
+    '**/vendor/**', '**/target/**', '**/node_modules/**', '**/dist/**', '**/.next/**',
+    '**/*.test.*', '**/*.spec.*', '**/*_test.*', '**/tests/**', '**/__tests__/**',
+    '**/*.d.ts', '**/*.generated.*', '**/generated/**', '**/*.min.js',
+  ],
+};
+
+/** Rule yaml: the project's own first, then the core's; none found -> DEFAULT_CONFIG. */
+function loadConfig(repoPath) {
+  const candidates = [path.join(repoPath || process.cwd(), '.rule', 'general', 'file-size-threshold.yaml'), RULE_PATH];
+  const rulePath = candidates.find((p) => fs.existsSync(p));
+  if (!rulePath) return DEFAULT_CONFIG;
+  const doc = yaml.load(fs.readFileSync(rulePath, 'utf8'));
   const rule = (doc && doc.rules || []).find((r) => r.id === 'ARCH-001');
   if (!rule || !rule.thresholds || !rule.scope) {
-    throw new Error(`ARCH-001: malformed rule source ${RULE_PATH}`);
+    throw new Error(`ARCH-001: malformed rule source ${rulePath}`);
   }
   return {
     warn: rule.thresholds.warn,
@@ -60,11 +72,26 @@ function loadConfig() {
   };
 }
 
+// The npm core ships without node_modules, so the scope globs (`**/`, `*`, `?`) are matched here.
+function globToRegExp(glob) {
+  let re = '';
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === '*' && glob[i + 1] === '*') {
+      i++;
+      if (glob[i + 1] === '/') { i++; re += '(?:.*/)?'; } else re += '.*';
+    } else if (c === '*') re += '[^/]*';
+    else if (c === '?') re += '[^/]';
+    else re += c.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+  }
+  return new RegExp('^' + re + '$');
+}
+
+const matchesAny = (p, globs) => globs.some((g) => globToRegExp(g).test(p));
+
 function isInScope(relPath, config) {
   const posixPath = relPath.split(path.sep).join('/');
-  if (!micromatch.isMatch(posixPath, config.include, { dot: true })) return false;
-  if (micromatch.isMatch(posixPath, config.exclude, { dot: true })) return false;
-  return true;
+  return matchesAny(posixPath, config.include) && !matchesAny(posixPath, config.exclude);
 }
 
 function countLines(text) {
@@ -127,7 +154,7 @@ function absoluteStatus(lines, config) {
 
 /** --staged: compare staged (index) content against HEAD. */
 function runStaged(config, repoPath) {
-  const cwd = repoPath || ROOT;
+  const cwd = repoPath || process.cwd();
   // -c core.quotePath=false: avoid octal-escaped/double-quoted non-ASCII paths
   // in porcelain output, which would break the plain string parsing below.
   const nameStatus = git(['-c', 'core.quotePath=false', 'diff', '--cached', '--name-status'], cwd);
@@ -217,7 +244,7 @@ function main() {
   const args = parseArgs(process.argv.slice(2));
   let config;
   try {
-    config = loadConfig();
+    config = loadConfig(args.repo);
   } catch (e) {
     console.error(e.message);
     process.exit(2);
@@ -230,7 +257,7 @@ function main() {
     } else if (args.file) {
       results = runFile(args.file, config);
     } else if (args.base && args.head) {
-      results = runRefDiff(args.base, args.head, args.repo || ROOT, config);
+      results = runRefDiff(args.base, args.head, args.repo || process.cwd(), config);
     } else {
       console.error('Usage: check-file-size.js --staged | --file <path> | --base <ref> --head <ref> [--repo <path>]');
       process.exit(2);

package/core/k-cli/README.md

@@ -33,7 +33,7 @@ cat k-cli.md
 ## 核心價值
 
 - **零依賴**：不需要 Dashboard 運行，直接呼叫底層工具
-- **spawnClaude 架構**：寫入操作透過 `spawnClaude` 直接啟動 Claude CLI，無需 headless.js 中間層
+- **spawnClaude 架構**：寫入操作透過 `spawnClaude` 直接啟動 Claude CLI
 - **dry-run 支援**：所有寫入命令支援 `--dry-run`，驗證但不執行
 - **可腳本化**：所有輸出支援 `--json` 格式，方便 pipe 和自動化
 - **明確偵測**：不猜測、不 fallback、不向上找目錄，偵測失敗就是失敗
@@ -50,8 +50,6 @@ cat k-cli.md
 | 讀取 | specialist list, task list, task get, project status... | 直接呼叫 |
 | 寫入（任務） | task create | → spawnClaude + Ansuz（分析需求 → Amelia 審查 role → 建立） |
 | 刪除 | task delete | → 直接 rm 檔案 |
-| 調度 | dispatch run TASK_XXX | → spawnClaude + Ansuz（讀 role → 判斷陣型 → headless.js） |
-| 調度 | dispatch run --auto | → spawnClaude + Ansuz（掃描 backlog → 逐個 dispatch） |
 | 執行 | specialist run | → spawnClaude + 指定 Specialist |
 
 ## 命令一覽
@@ -149,65 +147,13 @@ k-cli task create "描述"
 
 | 命令 | 說明 | 執行方式 |
 |------|------|---------|
-| `k-cli dispatch run <taskId>` | Dispatch 指定任務 | → spawnClaude + Ansuz + headless.js |
-| `k-cli dispatch run --auto` | 自動掃描 backlog 並 dispatch | → spawnClaude + Ansuz + headless.js |
 | `k-cli dispatch status <taskId>` | 查看 dispatch 狀態 | 直接讀取 |
 
 ```bash
-# 指定任務 dispatch（Ansuz 讀 role → 判斷陣型 → headless.js 執行）
-k-cli dispatch run TASK_340
-k-cli dispatch run TASK_340 --dry-run
-
-# 自動掃描（Ansuz 掃 backlog → 按優先級逐個 dispatch）
-k-cli dispatch run --auto
-k-cli dispatch run --auto --project-path /path/to/project
-
 # 查看狀態（自動搜尋 .kenaz/logs/ 或 .formation/logs/）
 k-cli dispatch status TASK_340 --tail 50
 ```
 
-#### dispatch run 流程
-
-```
-k-cli dispatch run TASK_XXX
-  │
-  └→ spawnClaude(Ansuz)
-       ├─ Step 1: task-api get → 讀取任務 role
-       ├─ Step 2: role → --skill, 判斷陣型（unit > solo > squad > legion）
-       └─ Step 3: node headless.js --skill={role} --task=TASK_XXX
-                    │
-                    headless.js 自動處理：
-                    ├─ auto-claim（backlog → active）
-                    ├─ 依賴預檢
-                    ├─ spawnClaude(agent) 執行任務
-                    ├─ ensureTaskComplete
-                    └─ postComplete（archive + git branch + merge）
-```
-
-#### Formation Role → Skill 對應
-
-| role | --skill | 說明 |
-|------|---------|------|
-| frontend | frontend | React/TypeScript UI、client-side |
-| backend | backend | API、DB、server-side |
-| designer | designer | 設計規範產出 |
-| qa | qa | 測試、Bug 驗證 |
-| sre | sre | 基礎設施、部署 |
-| developer | developer | 通才兜底 |
-
-Skill 定義檔：`.formation/legacy/{role}.yaml`
-
-#### 陣型判斷
-
-原則：能 unit 不 solo，能 solo 不 squad，能 squad 不 legion。
-
-| 陣型 | 條件 | headless.js 參數 |
-|------|------|-----------------|
-| unit（預設） | 目標明確、單一 scope | `--skill={role} --task=TASK_XXX` |
-| solo | 需多角度分析 | `--formation=solo --skill=strategy --task=TASK_XXX` |
-| squad | 多個獨立子任務可並行 | `--formation=squad --skill=blitz --task=TASK_XXX` |
-| legion | 有順序依賴或即時協調 | `--formation=legion --skill=forge --task=TASK_XXX` |
-
 ### Project 命令
 
 | 命令 | 說明 | 執行方式 |
@@ -274,7 +220,6 @@ k-cli project install k-cli --dry-run
 | `--dry-run` | 驗證但不執行（適用所有寫入 / 調度命令） |
 | `--json` | 輸出 JSON 格式 |
 | `--project-path <path>` | 指定子專案路徑（使用 `.kenaz/project.yaml` 中的 `project_path` 值） |
-| `--auto` | 自動掃描模式（僅 `dispatch run`） |
 | `--force` | 跳過品質檢查（僅 `task create`） |
 | `--no-git` | 初始化時跳過 Git（僅 `project initialize`） |
 | `--core-path <path>` | 覆蓋自動偵測的 core 路徑（僅 `project initialize`） |
@@ -306,7 +251,6 @@ k-cli/
 │   │   ├── update.ts      # task update（直接 task-api.js）
 │   │   └── delete.ts      # task delete（直接 task-api.js）
 │   ├── dispatch/          # Formation 調度功能
-│   │   ├── run.ts         # dispatch run（spawnClaude + Ansuz + headless.js）
 │   │   └── status.ts      # dispatch status（直接讀 log）
 │   └── project/           # 專案管理功能
 │       ├── status.ts      # project status（含 project.yaml 詳情）
@@ -333,10 +277,6 @@ k-cli
   │   ├─ task/create       → Ansuz 分析需求
   │   │                       → Agent tool subagent（Amelia 審查 + role）
   │   │                       → task-api.js create（最終建立）
-  │   ├─ dispatch/run      → Ansuz 讀 role + 判斷陣型
-  │   │   TASK_XXX            → headless.js --skill={role} --task=TASK_XXX
-  │   └─ dispatch/run      → Ansuz 掃 backlog + 逐個 dispatch
-  │       --auto              → headless.js × N
   │
   └─ spawnClaude（Specialist 直接執行）
       └─ specialist/run    → session.js（組裝 prompt）+ spawnClaude
@@ -354,38 +294,6 @@ spawnClaude(opts)
   └─ spawn(claude, args)    → stdin pipe prompt, stream-json 輸出
 ```
 
-### Git 流程（自動觸發鏈）
-
-```
-k-cli dispatch run TASK_XXX
-  └→ Ansuz → headless.js
-       ├─ auto-claim（backlog → active）
-       ├─ 依賴預檢
-       ├─ 保存當前分支 → .formation/.dispatch-branch
-       ├─ spawnClaude(agent) 執行任務
-       └─ agent exit 0 → 自動觸發：
-            ├─ ensureTaskComplete → task-api complete
-            └─ postComplete()
-                 ├─ archive（done/ 超過 10 個 → archived/）
-                 └─ gitBranchAndMerge()
-                      ├─ stash 未提交變更
-                      ├─ checkout -b task/task_xxx
-                      ├─ unstash + git add + commit
-                      ├─ checkout {userBranch}
-                      ├─ merge task/task_xxx --no-ff
-                      └─ 提示: merge to main when ready
-```
-
-| 階段 | 誰處理 | 自動/手動 |
-|------|--------|----------|
-| claim | headless.js | 自動 |
-| agent 執行 | headless.js → spawnClaude | 自動 |
-| task complete | headless.js ensureTaskComplete() | 自動 |
-| archive | post-complete.js | 自動 |
-| task branch + commit | post-complete.js gitBranchAndMerge() | 自動 |
-| merge 到 user branch | post-complete.js | 自動 |
-| merge 到 main | **用戶** | **手動** |
-
 ## Dry-Run 行為
 
 `--dry-run` 適用於所有有副作用的命令：
@@ -393,7 +301,6 @@ k-cli dispatch run TASK_XXX
 | 命令 | dry-run 行為 |
 |------|-------------|
 | `specialist run` | 組裝 prompt → 顯示 agent + prompt 長度 → **不 spawn Claude** |
-| `dispatch run` | 組裝 Ansuz prompt → 顯示模式 + 資訊 → **不 spawn Ansuz** |
 | `task create` | 組裝 Ansuz prompt → 顯示將建立的任務資訊 → **不啟動 Ansuz** |
 | `task update` | 組裝 task-api args → 顯示將更新的內容 → **不呼叫 task-api** |
 | `task delete` | 組裝 task-api args → 顯示將刪除的任務 → **不呼叫 task-api** |