j3w1zsh: Instructions file for Codex

j3w1zsh agent instructions

Purpose and authority

j3w1zsh is a public, reproducible shell-first workstation framework for native official Arch Linux, official Arch Linux under WSL 2, and native Termux on Android. Preserve its true-black, blood-red, and warm-white design while keeping installation safe, resumable, explicit, and portable across those three supported targets.

The current tracked code, schemas, presets, versions.env, wiki-lock.json, compatible pinned Wiki pages, and tests are the source of truth. Conversation, generated state, screenshots, and the former product are not current authority.

Use this precedence:

1. explicit current owner authorization;
2. this file and the authorized task scope;
3. schemas, compatible pinned Wiki contract, and accepted repository policy;
4. current code, Git, configuration, and runtime evidence;
5. inference.

Stop rather than inventing a new business, security, schema, privilege, or release decision.

Start every run

1. Read this file completely.
2. Inspect git status --short --branch, remotes, execution surface, and relevant worktrees.
3. Preserve unrelated human and agent work. Never assume a clean checkout, platform, or shell.
4. Select the topic in agent-context.json; load only its required code paths and compatible Wiki pages. Use j3w1zsh wiki context TOPIC when the pinned Wiki is locally available.
5. Trace bin/j3w1zsh through the selected scripts/commands/, scripts/lib/core/, platform adapter, and phase before changing user-facing behavior.
6. State scope, diagnose first, implement the smallest complete change, add focused regression coverage, update affected Wiki/root contract, and run the verification below.

If a decision exists only in conversation, encode the authorized decision in tracked code, tests, and the appropriate contract as part of the same change.

Security and privacy

• Never commit or print private keys, passwords, passphrases, tokens, OAuth/Codex sessions, GitHub CLI authentication, private repositories, documents, histories, caches, logs, installation IDs, personal absolute paths, or private database content.
• Public keys and Git identity still require an explicit documented reason before tracking.
• Keep privilege narrow, visible, planned, and platform-specific. Never add passwordless sudo.
• Never automate WSL unregister, home deletion, public SSH exposure, router/firewall changes, power-policy changes, secret migration, or arbitrary third-party execution.
• Validate every managed or recovery target under the intended home or named host adapter.
• Use authoritative downloads, immutable commits/releases where practical, and verified static checksums. Never recommend piping mutable main directly into a shell.