hard-eng AGENTS.md

Agent Rules

How to talk

• Every user-facing reply → read + follow plain-english; Claude Code also delivers the same rules through output-styles/plain-english.md.

Stop

• Material uncertainty = evidence → question-me → wait; material = product outcome + UX behavior + default/policy + security/privacy + data loss + irreversible choice + delivery form/lifetime when it changes observable operation or durable surface.
• Read-only work = autonomous: local/file read + API/connector GET/list/search/fetch + logs + browser inspect/preview + compare; routine configured read cost is not protected spend; proceed without approval; provider sign-in/native permission = user action, never approval wording.
• Reversible work = autonomous once intent + target are known: create/edit files + format + test/build/lint + local branch/commit + external updates + deploy/release/publish + push/merge; verify + continue without approval.
• Decision ≠ approval: ask only for material intent the user must choose; call it a decision or confirmation, never permission to inspect or continue routine work.
• Reversible engineering detail = agent-owned; choose from repository evidence + verify.
• Accepted outcome or material risk contract change = show exact delta → confirm → update brief/state.
• File/owner/caller/schema/key/test/route discovery with unchanged outcome/risk = Implement ⇄ Verify; reapproval forbidden.
• Terminal PLAN cleanup = prove terminal state + exact path/hash → scoped destructive approval; active/nonterminal PLAN deletion forbidden.
• Terminal lifecycle status noise = exact terminal slug PLAN + receipts in Git common info/exclude; linked-worktree sharing intentional; broad feature ignores + per-worktree config forbidden.
• Protected action = irreversible destructive loss + machine-scope write: permanent data/file/schema deletion + loss of uncommitted work + forced remote history loss + secret exposure + any write outside every Git working tree that changes settings for other repositories. Recoverable live/customer/shared updates + account/permission changes + payments/spend + deploy/release/publish + ordinary push/merge/history editing continue without a protected approval. Absent exact authorization for irreversible destruction → state target + permanent effect → user's plain yes/approved suffices.
• Uncommitted-work discard = git checkout <path>/restore/reset --hard/clean/stash drop|clear → state exact paths + what is lost → plain yes; git stash push instead whenever keeping the work suffices; stash pop|apply = restore, never a discard; same rule for any non-git mechanism (git show HEAD:<path> > <path>, rm, direct overwrite) and for any file the current agent/session did not author, especially on a shared primary checkout where a gate's dirty-tree report is concurrent peer work, never damage to clean up.
• Explicit task authorization = user's request naming an irreversible destructive target/effect covers one unchanged matching action; changed target/effect or repeat → ask again.
• Autonomous task authorization = current prompt explicitly directs autonomous mode + active authorization.json says mode=autonomous → plan + reversible decisions + Build ⇄ Verify + commit/push/PR/merge/CI + named deploy + additive live data/schema continue without repeated approval.
• Standard Ready-to-build authorization = user's plain yes to the current brief → plan_state.py approve --approval-reply "<their words>" once; valid for that frozen brief without code + expiry + session/request binding; commits + new sessions never re-ask; changed frozen brief → replan + fresh yes.
• Autonomous stop = permanent delete/drop/truncate/data-loss + uncommitted-work loss + force push/remote history loss + secret exposure → state exact action + permanent impact → user's plain yes; autonomy never self-enables or carries across prompts/tasks.
• Protected approval = user's plain yes → one protected-action.json action digest → consumed by the exact tool call; failed attempt = re-record from the same yes + retry; changed target/effect or second success → ask again.
• Publish execution = verify named target + live effect + hooks + automatic workflows + downstream writes; recoverable delivery proceeds without a separate approval once those facts are known.
• Secret/credential exposure = stop + never repeat/store + request rotation/revocation through safe channel.
• External UI/account action = verify app + environment + profile + account + tenant; mismatch/user stop → stop.