AGENTS.md and the wave rules agree on how work ships; gates derived from ci.yml

- improvise-rzux: AGENTS.md now states the per-agent PR workflow the wave
  skill uses (adversarial review at the head SHA, merge on GitHub, local main
  fast-forwards to gh/main) and points to SKILL.md "Shepherding". The
  obsolete one-PR-per-wave and local-integration text is cut.
- improvise-x1uk: the Beads integration block is regenerated whole by bd
  (bd init, bd setup factory|opencode|mux). It is replaced with bd 1.3.0's
  own minimal render, which no longer says git merge origin/main, and the
  repository's policy (no team-maintainer opt-in, the TODO exception that
  had been hand-edited inside the markers) moves to a section outside them.
- improvise-anmm: the ID audit scans .agents and the tracked .claude files,
  excludes the kb skill's example crate name, and anchors its matcher so a
  ticket body saying "not found" is not reported as a dead id.
- improvise-xolb: agent-rules' gate list is the test/js/kb CI jobs step for
  step, with the conditional jobs (wasm incl. improvise-gp, harness-lint,
  build+browser incl. the bundle node tests) and the excluded one named.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze

.agents/skills/wave/agent-rules.md

@@ -29,12 +29,12 @@ not in a second copy.
 5. **Before pushing a fix to an existing PR, check `gh pr view <n> --json
    state`.** GitHub deletes a merged PR's branch. A push to it then prints
    `* [new branch]` and lands nowhere. Why: `AGENTS.md`, "Shipping a wave".
-6. **The "Session Completion" block near the end of `AGENTS.md` does not apply
-   to you.** It says `git merge origin/main` and then a bare `git push`. On a
-   wave branch the first is the #145 trap and the second is refused (rule 4).
-   Rules 1–5 replace it. The block sits between bd's generated
-   `BEGIN/END BEADS INTEGRATION` markers, so it is not edited by hand
-   (improvise-x1uk).
+6. **The Beads "Session Completion" block near the end of `AGENTS.md` does not
+   set your git policy.** This repository does not opt in to the block's
+   "team-maintainer" profile. On a wave branch that profile's pull and bare
+   `git push` would be refused (rule 4), or worse. Rules 1–5 are your git
+   policy. The block is bd's and bd regenerates it whole, so it is not edited
+   by hand: `AGENTS.md`, "The Beads blocks are bd's" (improvise-x1uk).
 
 ## Commit early: a worktree is not durable storage
 
@@ -47,14 +47,33 @@ deleted worktree. Tidying history before the PR is fine; losing it is not.
 ## Gates
 
 ```
-direnv exec . cargo test --workspace --no-fail-fast
-direnv exec . cargo clippy --workspace --all-targets -- -D warnings
 direnv exec . ./scripts/fmt-workspaces.sh          # NOT cargo fmt --all; exit 2 = the gate did not run
-direnv exec . python3 scripts/check-comment-runs.py --check-evidence
-direnv exec . ./scripts/checkers.sh
+direnv exec . cargo clippy --workspace --all-targets -- -D warnings
+direnv exec . cargo test --workspace --no-fail-fast
+direnv exec . python3 scripts/check-comment-runs.py --self-test
+direnv exec . python3 scripts/check-comment-runs.py --check-evidence   # also answers the comment cap
+direnv exec . python3 scripts/check-ci-graph.py --self-test
+direnv exec . python3 scripts/check-ci-graph.py
+direnv exec . ./scripts/checkers.sh                # every suite in scripts/, its own self-test included
+direnv exec . tpl prolog-sessions/kb.pl -g "(kb_consistent -> halt(0) ; (kb_report, halt(1)))"
 direnv exec . ./scripts/node-test.sh 'web/tests/*.test.js'
 ```
 
+This list is the `test`, `js` and `kb` jobs of `.github/workflows/ci.yml`,
+step for step, and this file is the one place it is written down. Change it in
+the same PR that changes CI. The other CI jobs are conditional, below, or left
+out on purpose:
+
+- **`wasm`**: when you touch a crate it checks (next bullet).
+- **`harness-lint`**: when you touch `harness/opfs-contract`, run
+  `cargo clippy --target wasm32-unknown-unknown --all-targets -- -D warnings`
+  from that directory. Its format half is already `fmt-workspaces.sh`.
+- **`build` and `browser`**: when you touch `web/`, `harness/`, or the surface
+  the page calls in `improvise-wasm-client` or `improvise-worker-server`
+  (third bullet).
+- **`pages-deploy`** is left out. It deploys, and it runs only on a push to
+  `main`. What guards it locally is `check-ci-graph.py`, which is in the list.
+
 - **Never `cargo fmt --all`.** It reaches only **one** of this repo's two
   workspace roots, because `harness/opfs-contract` declares its own
   `[workspace]`. The obvious repair is worse: `cargo fmt -p opfs-contract` from
@@ -70,10 +89,17 @@ direnv exec . ./scripts/node-test.sh 'web/tests/*.test.js'
 - **`--no-fail-fast`**, because plain `cargo test --workspace` stops at the
   first failing binary. Use it for any claim about blast radius.
 - If you touch a browser-bundle crate (core, formula, io, protocol, command,
-  wasm-client, worker-server), also run
+  wasm-client, worker-server) or `improvise-gp`, also run
   `cargo check --target wasm32-unknown-unknown -p <crate>` **for each crate**.
   CI checks each one separately, so feature unification cannot hide a leak.
-- If you touch `web/` or `harness/`, run the Playwright suite in `harness/`.
+- If you touch `web/`, `harness/` or the page's wasm surface, run
+  `./harness/build.sh`, then
+  `./scripts/node-test.sh 'web/tests/bundle/*.test.js'`, then `npm ci` and
+  `npx playwright test` in `harness/`. The bundle tests sit outside the
+  `web/tests/*.test.js` glob and read the built `web/pkg`, so the standard list
+  never runs them. They failed only in CI once. A fresh worktree has no
+  `harness/node_modules`, and Playwright then reports a missing
+  `@playwright/test`, which reads like a broken checkout.
 - **If you change the grid's row or column count, also grep
   `harness/fixtures/*.improv` and `harness/tests/*.spec.js`.** On PR #176 a
   Playwright spec pinned the old collapsed-group row count. `cargo test` cannot