FlowGuard AGENTS.md

FlowGuard Project Rules

For non-trivial work, select the smallest current FlowGuard public owner; clear satellites are direct peers and unclear ordinary behavior/state work uses flowguard.

FlowGuard repository: https://github.com/liuyingxuvka/FlowGuard

FlowGuard agent skill suite: Primary agent surface: the current clean consumer projection at $CODEX_HOME/skills/flowguard/SKILL.md; the project does not copy the FlowGuard suite into its local tree, and the Python package/CLI is not the AI-agent skill installation surface.

Project record: .flowguard/project.toml; machine log: .flowguard/adoption_log.jsonl; human log: docs/flowguard_adoption_log.md.

Current adoption record: FlowGuard check-engine version: 0.68.16; FlowGuard schema version: 1.0.

Before non-trivial work run python -m flowguard project-audit --root .; if the installed engine is newer, run full project-upgrade scanning and affected revalidation, and if older connect the current engine.

Use latest-schema-first direct replacement; obsolete fields, aliases, wrappers, and alternate success paths have no normal-runtime fallback.

Only the sole content-addressed observed_implementation head is current; targets, experiments, discovery, and green candidates do not own current behavior.

Change model authority only through one accepted ModelRevisionSet; keep the revision-local delta distinct from its complete CurrentEffectiveIntentView, bind every current model owner exactly, persist evidence before the pointer, and restore/compensate effects before rollback.

Default replacement means dispose the old path: every replaced field, alias, wrapper, or alternate success needs an explicit delete/block/migrate/delegate/repair/replace/scope disposition.

Broad behavior claims require an independent BehaviorCommitmentLedger inventory, one plane and primary owner per admitted promise, and Primary Path Authority for path-sensitive rows.

Commitments stay in product_runtime, agent_operation, or development_process; select a bounded same-plane owner closure and keep related planes as typed context only.

Declare ledger mode first; only bootstrap/backfill may discover broadly, while add/change/remove/miss stays on the affected commitment closure.

Field-bearing work uses FieldLifecycleMesh and accounts owner, readers/writers, projection, lifecycle evidence, and old-field disposition.

UI runnable claims and file/work-package claims need current real-surface or payload evidence before broad confidence.

Commitments with path_sensitive=true need one Primary Path Authority, visible primary failure, no alternate automatic success, and current exhaustion/test/risk evidence.

One exact purpose has one intent, commitment, and primary path; equivalent UI/API/CLI/adapter/wrapper surfaces delegate rather than own independent success.

UI Flow Structure owns product language and complete rendered control/display/transition/overlay/recovery/blindspot coverage for full UI claims.