fix(cursor): reject unenforceable output caps

AGENTS.md

@@ -52,4 +52,16 @@ Target `bloodf/durindoor:main`. Do not send PRs to `decolua/9router:dev` from th
 
 `npx commitlint --from=origin/main --to=HEAD` must exit 0. The PR title must also pass `echo "<title>" | npx commitlint`, because squash-merge uses the title as the commit subject.
 
-`npm run lint` and `cd tests && npm run test:ci` need to be green, or the PR waits. The body lists scope, tests, docs, and baseline impact. One branch per PR. Force-push only on that branch.
+PRs require root lint and independently reviewed scoped checks, or a full checkpoint when the risk floor requires it. The body lists scope, exact base/head, tests, docs, and baseline impact. One branch per PR. Never force-push without explicit authorization.
+
+## Local gate authority
+
+`scripts/local-ci.mjs` defaults to `--mode full`, preserving the original lint/build, conditional website, full `test:ci`, report and commitlint jobs. Bootstrap must pass that old full gate on the exact independently reviewed head before this scoped policy can merge. Full checkpoints also run after upstream integration, every five merges, each stage boundary, final readiness, and shared-core/security/DB/dependency changes. An empty baseline remains mandatory.
+
+Scoped mode accepts only an independent reviewer's frozen JSON selection. It binds `base`, `head`, `policySha256`, `runnerSha256`, `reviewer`, and literal `tests` paths. Supply the independently frozen hashes with `--policy-sha` and `--runner-sha`; an author-supplied reviewer string is not approval. The trusted integration owner obtains review evidence outside the candidate, freezes the runner and its imported baseline helpers from a reviewed checkout, and verifies receipt files and hashes before publishing `V5 Local CI`. Never execute a candidate runner to approve itself. This runner never publishes statuses or accesses GitHub credentials.
+
+The deterministic floor permits scoped documentation checks for Markdown under `docs/` or `internal/docs/`, except the three policy documents. Translator request/response implementations and test files require all base-inventory offline translator tests plus mapped media/native/tool-result/streaming callers. The exact upstream-watch domain (`scripts/upstream-ported-ids.sh`, `tests/unit/upstream-watch-filter.test.js`, `internal/docs/upstream-sync.mdx`) requires the base-inventory `unit/upstream-watch-filter.test.js`, plus `unit/upstream-watch.test.js` when present, recorded `bash -n scripts/upstream-ported-ids.sh`, root lint and docs checks. Its workflow, ledger and other helpers are not scoped. Any deletion, missing mandatory caller, translator registration/schema/shared helper or policy change requires full mode. Reviewer additions can broaden but never narrow that floor. Unknown paths, mixed domains, contributor policy, gate/test selection, auth/crypto/money/admission, DB, registry, dependencies, toolchain, website and build inputs require full mode. Provider registry changes also need owner-run schema/catalog/generated-index checks; security/accounting changes require frontier review and relevant cross-route/concurrency/DB-engine evidence.
+
+Run focused tests directly from `tests/` with `node node_modules/vitest/vitest.mjs run <explicit-files> --maxWorkers=2`. Root runs require `--config tests/vitest.config.js`. Do not pass selectors to `npm --prefix tests run test:ci`: its wrapper does not forward them. Scoped evidence is not global coverage.
+
+Every command has a five-minute ceiling and emits start/finish progress. Keep snapshot, HOME, DATA_DIR, npm cache and reports private. The child environment uses an allowlist, excluding publisher/provider credentials, real-provider opt-ins and loader injection. Reuse pooled dependencies only after lockfile, Node 20.20.2 ABI and platform checks; never install through shared symlinks. Failed commands, empty executed test collections, stale reports/receipts, missing mandatory selectors and SHA drift fail closed. Missing ownership-correct unprivileged execution blocks bootstrap; never weaken trusted-shell predicates, skip security tests, use root/sudo or escape permission boundaries.

internal/docs/README.md

@@ -17,6 +17,7 @@ Start with [`AGENTS.md`](../../AGENTS.md) for the contributor contract. [`PRODUC
 - [Postgres schema migrations](./postgres-migrations.mdx)
 - [Brand guide](./brand-guide.mdx), [dashboard design system](./design-system.mdx), and [provider asset policy](./provider-brand-assets.mdx)
 - [Brand image prompts](./brand-prompts.md) and [provider audit evidence](./provider-expansion-audit.json)
+- [OmniRoute security-audit applicability (#1150)](./omniroute-security-audit-1150.md)
 
 Keep implementation details, source ownership, compatibility constraints, porting decisions, evidence limits, and validation procedures here. Keep public pages concise, with complete setup steps, supported behavior, limits, and recovery instructions. When behavior changes, update both audiences where relevant.
 

internal/docs/agent-workflow.md

@@ -42,7 +42,7 @@ The watch workflow creates issues when dispatched. Reading this guide does not a
 
 Use [Testing](./testing.mdx) for the separate test package and [Local development](./local-development.mdx) for isolated storage and UI checks. Root `npm test` is not the CI gate.
 
-Required PR checks include root lint and `cd tests && npm run test:ci`. Run documentation checks after moving or editing references. Build the website when public docs, shared demo components, site code, or asset publication change.
+PR checks follow the scoped-PR/full-checkpoint contract in `AGENTS.md`: root lint, deterministic changed-path risk floor, independent reviewer additions, and exact-head receipts. Unknown/shared-risk changes require full mode. Bootstrap must pass the original full gate before scoped policy merges; full checkpoints run every five merges and at upstream/stage/final boundaries. Never let a candidate approve its own runner, test map or receipts. Freeze the independently reviewed runner plus imported baseline helpers outside the candidate. The trusted integration owner validates live base/head, policy/toolchain/selection hashes, command logs and reports before publishing the unchanged `V5 Local CI` status. This runner never publishes statuses. Run documentation checks after moving or editing references. Website rendering/build inputs require a full website build. No workflow or branch-protection edits are part of this local policy.
 
 Describe resulting behavior, source scope, tests, public documentation, internal references, and baseline impact. Distinguish offline assertions, browser behavior, credential-backed checks, and production evidence. A registry entry is not proof that a real provider account works.