paranoia: Instructions file for Claude Code

Claude repository instructions

@AGENTS.md

AGENTS.md is canonical and must be followed in full. In particular:

• write explicit, proportionate, frozen stakes rather than vague “high stakes” language;
• after plan approval, review the implementation branch—not the plan—unless design is explicitly reopened, and label runs PLAN versus CODE;
• treat recurring classes as an architecture checkpoint, not permission for another patch;
• use broad cold structural coverage for tracked plan and branch census/final regression, while targeting intervening correction rounds to open debt and correction effects;
• preserve the engine owner of a pending cold-final gate; another engine's clean review cannot discharge it, while findings from that review still reopen correction;
• prioritize accurate, fast, workable behavior and a small architecture over out-of-scope hardening;
• keep operational timeouts generous enough for normal thorough reviews; control runaway cost with bounded calls, batches, packet sizes, and phases rather than truncating valid model work;
• keep plan claim verification on by default with reviewer-native search used only for URL discovery, server-controlled HTTP(S) capture and Trafilatura extraction, same-session binding with browsing disabled, a cold authority/entailment attestation, no Claude WebFetch, official/primary evidence, hard UGC non-authority, exact actionable source packets, and retained-evidence freezing for exact unchanged supported claims after exhaustive round 1; mechanically limit inventory to external facts, externally issued design principles/requirements, and promised external-system behaviors; leave repository mechanics, internal history, implementation conformance, and function bridges to structural/code review and tests; target model/web work at edited, new, refuted, and unverified external claims, requiring a full current captured and cold-attested packet for every non-freezable claim instead of compact-verdict churn; accept only canonical HTTP(S) sources as governing evidence; validate retained inventory before capture; attest exact replacement wording independently; compose per-claim limits with aggregate capture/binding and whole-plan monotonic budgets; persist evidence debt before the structural phase; and fail closed over active legacy state;
• never let the plan under review serve as evidence for its own assertions; bind claims to authoritative external sources;
• let the calling coding agent autonomously edit from those packets before the next round; no human is required, and an unchanged rerun is not a correction;
• apply the same capture boundary to default-on arbitration research; deciders get one identical packet and no live web, caller IDs are rejected across the complete rendered packet, and initialized submodule snapshots record their checked-out commit, while research: false is explicitly repository-only;
• route snapshotting, materialization, refs, labels, citations, trees, symlinks, and blob reads through the shared inert Git launcher so missing promised objects cannot lazy-fetch;
• require claim closure, class closure, real acceptance, updated docs, and a governing computed CONVERGENCE: NOT-BLOCKED before delivery.
• treat AGENTS.md as authoritative for durable concession challenges and derive every active-class cardinality from class_closure.MAX_ACTIVE_CLASSES; do not restate a numeric policy limit here.
• preserve class closure on staged plan and branch reviews: explicitly disposition every governing finding as one-off/new/existing, bind every new record, use the canonical class engine, and expose CLASS-REGISTER and CLASS-CLOSURE; structural debt alone is not feature parity. Ambiguous persistence uses CLASS-CLOSURE: STATE-UNAVAILABLE, not unconfirmed class counts.
• preserve an atomic lane finding that violates several active classes and let its source disposition fan out to one distinct governing finding per affected class; do not split the observation merely to satisfy the settlement schema. Require every repeated-source target to be an existing-class finding backed by its own distinct violated assessment citing that source.
• include the exact server-rendered class decision surface in the initial staged prompt retained by the one same-session validation retry: preserve outcome-free standalone lifecycle actions, non-downgrading severity, both legal unmechanized branch replacement forms (procedural replacement and mechanized replacement), mechanization-preserving replacement, and the distinct census/final/debt-bound correction/fresh-finding outcome-authority paths. A violated gated class requires replacement. Keep the class_closure.MAX_ACTIVE_CLASSES-derived schema/provider boundary, durable failure diagnostics, and atomic settlement unchanged; this remains all-or-nothing settlement, with no cross-round repair state.
• derive the deterministic close for a satisfied open unmechanized class, and reuse a complete post-validation-rejection census only when its snapshot, full body/debt input, stakes, mode, active-class state, engine settings, plan context, exact composed lane prompts, and cache schema all match exactly; execution failure, timeout, cancellation, and failed retry delete older cache, persist as generic staged failure, and are never reusable. Only terminal consolidation validation uses validation debt; lane, follow-up, and consolidation-preflight validation are structured staged failures carrying exact role, kind, and message; preserve timeout, unavailable, provider, execution, and retry roles rather than flattening them.