Symbiont AGENTS.md

Symbiont — Agent Instructions

Symbiont (Symbi) is a Rust-native, zero-trust agent framework for building autonomous, policy-aware AI agents. Part of the ThirdKey trust stack: SchemaPin → AgentPin → Symbiont.

• Docs: https://docs.symbiont.dev
• Repo: https://github.com/ThirdKeyAI/Symbiont
• Crate: https://crates.io/crates/symbi

Project Structure

crates/
├── dsl/              # Symbi DSL parser with Tree-sitter integration
├── runtime/          # Agent runtime (scheduling, routing, sandbox, AgentPin)
├── channel-adapter/  # Slack, Teams, Mattermost adapters
├── repl-core/        # Core REPL engine
├── repl-proto/       # JSON-RPC wire protocol types
├── repl-cli/         # Command-line REPL interface
├── repl-lsp/         # Language Server Protocol implementation
src/                  # Unified `symbi` CLI binary

Build and Test

cargo build --workspace
cargo test --workspace
cargo clippy --workspace
cargo fmt --check

All four commands must pass before committing. Clippy must produce zero warnings.

Code Style

• Rust edition 2021
• Run cargo fmt before committing
• Run cargo clippy --workspace and fix all warnings before committing
• Inline tests in source files using #[cfg(test)] mod tests
• ES256 (ECDSA P-256) only for AgentPin identity — reject all other algorithms
• Agent files use .symbi (canonical) — .dsl is supported indefinitely for backward compatibility. Use dsl::is_symbi_file / dsl::strip_symbi_extension for file discovery instead of inlining extension checks. New scaffolding emits .symbi only.

Commit Guidelines

• Write concise commit messages focused on the "why"
• No mention of AI assistants or co-authoring in commit messages
• Use date command to determine the current date when adding dates to docs

Security

• Zero-trust by default: all inputs are untrusted
• Cryptographic audit trails for agent actions
• Policy engine enforces runtime constraints via the Symbi DSL
• AgentPin integration for domain-anchored agent identity
• SchemaPin integration for tool schema verification
• Private keys (*.private.pem, *.private.jwk.json) must never be committed