Neuroverseos-governance: Instructions file for Codex

AGENTS.md — for people and coding agents working in this repo

Two formats, one engine. neuroverse-governance/1 is the general contract (AI agents calling tools in scopes under a principal's authority, SPEC.md § 16); robot-domain-rules/3 is the robotics dialect (actions in areas, SPEC.md § 1–15). Both are decided by one evaluate, one evaluatePlan, one conflict check and one backtest, through the dialect table in src/model.ts. The robotics dialect is robot-domain-rules 0.5.3 unchanged: its 261 conformance cases are byte for byte the published ones, and a change that alters any of them is a regression unless SPEC.md § 11 gets an erratum line and the change is additive.

The invariants you must keep

PRINCIPLES.md is the contract. Each principle is enforced by conformance cases in both formats, and any change that breaks one is a bug, not a redesign. In one line each:

1. Every rule carries a declared authority. source and setBy on every rule; the engine invents nothing; a rule from an agent or a system is weighed by setBy, never by who wrote it; a mission's rules carry the authority plan, below every declared one.
2. Authority is declared, layered, and only tightens. authorities highest first; a lower level can only tighten; authority-override is named and has no effect; approvals must hold what wait.by names; a mission has no allow; a delegate's authority never grows.
3. AI writes and proposes; the rulebook decides. No model and no clock in evaluate.ts, plan.ts, check.ts, compile.ts, governance.ts, backtest.ts; the structured then decides, never prose; a draft's setBy comes from the caller, never from the model. A plan is checked step by step on projected facts and by planRules; it is never written here. The model's text about its intent is not an input anywhere.
4. Unknown means no; a missing fact is never a yes. /3: required_facts, area_declared, role_declared, role_permits_action, unknown_action. /1: required_facts, args_wellformed, scope_declared, role_declared, scope_permits_tool, role_permits_tool, unknown_tool, delegation_exceeds_authority. Only declared defaults are filled in; history is the caller's and a rule that needs it and does not get it refuses; a projected fact out of range refuses, never clamps; an undeclared, missing, mistyped or doubly-supplied argument is args_wellformed before any rule is weighed.
5. Every decision explains itself. reasons, trace, setBy, limits, then, fingerprint; RFC 8785 canonical JSON and the SHA-256 fingerprint (over UTF-8, findings excluded) are reproduced byte for byte; a /1 PAUSE that rejected approvals carries approvalsRejected: [{ id, nonce?, code, reason }] — those four members and nothing else, never the approval, its signature or key material.
6. Waiting has two meanings, and approval is not a fact. Approval waits return approvalRequests and are cleared by a sufficient approval; condition waits are cleared only by facts. With trustedKeys declared, only the verified handle verifyApproval returned (src/verified.ts; a verified member in request data is ignored) counts, bound to the rule, the rulebook fingerprint and — /3 — the participant, action and area, or — /1 — the principal, participant, tool, scope and fingerprint(args), valid at request.now, with a nonce not in consumedApprovals; it clears that wait only, each approval clears at most one wait, a plan consumes nonces step by step. A rejected approval is a PAUSE with a code, never a BLOCK. Facts, now, history, the scope, the delegation chain and the approvals come from the harness, never from the requester.
7. Conflicts are surfaced, never quietly resolved. Eight finding kinds (unmatched_selector is on one rule, no witness); exact for the rule language on reachable requests, with a witness on every certain finding between two rules, in the rulebook's own words (tools and scopes for /1); "possible" only for history conditions; compile never hides findings and validateRulebook re-derives them. The Z3 cross-check (test/z3-crosscheck.test.ts) must keep agreeing on every pair.
8. One law for everyone. Robots, people and agents, both formats, through one evaluate; selectors by ID, kind, tag and exclusion; area and scope role limits as re-derived never rules; a subagent may use a tool only if its own role and every role in the chain list it, and a mission binds delegates (who: "*").
9. Rules say what may happen; evidence says what is true. Facts are trusted; this is not a safety system and not a judge of text (BOUNDARY.md). The adapter runs the executor only on ALLOW or LIMIT, with the limits; anything that fails before it is a BLOCK with nothing run and the reservation and nonce claims given back; every nonce the decision used is claimed atomically (consumed.claim) before the executor, so two concurrent calls with one approval cannot both run; once the executor has been invoked a throw is an uncertain outcome (outcome: "uncertain"): spend committed, nonces consumed, history appended, harness.reconcile told — never a release, never an un-consume; the arithmetic behind a cumulative limit (reserve, commit, release) is the harness's, and the engine only compares.