diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md index dba71e9..8a6403b 100644 --- a/.claude/CLAUDE.md +++ b/.claude/CLAUDE.md @@ -1 +1,67 @@ -@../AGENTS.md + +# Claude Code repository contract + +## Scope + +- GDS repository ID: `repo_01KXEDY8XHS7RFV8KTJHDTZ8NF`. +- Roles: `module`. +- Canonical repository facts: `.gds/repository.yaml`. +- Applied policy bundle: `.gds/bundle.lock.yaml` (`0.1.0-dev`). +- This is a first-class Claude Code projection compiled from the same typed + inputs as `AGENTS.md`; neither projection is a manual policy source. + +## Repository boundaries + +- Treat this Git repository as one independent mutation boundary. +- Preserve unrelated dirty changes, branches, worktrees, and submodules. +- Run `gds context --json` before work crosses repository boundaries. +- Do not edit generated projections; change the declared canonical input and + regenerate. + +## Safety + +- External writes require explicit approval: `true`. +- Generated projection edits: `forbidden`. +- Private parent context persistence: `forbidden`. +- Visibility: `public`; data: `public`. + +## Verification commands + +- Test: `python3 cli-tools/validate_public_contracts.py`. + +## Claude workflow routing + +- Start here: run `gds-orient` (or `gds context --json`) to resolve scope before + any cross-repository work. +- Active skill profiles: `core, module`. Five profiles exist in total + (`core`, `estate-admin`, `module`, `device`, `portfolio`); only the listed ones + are active for this repository. The catalog is `skills/registry.yaml`, and each + skill lives under `skills/canonical//SKILL.md`. +- Load procedural detail from the applicable installed GDS skill projection or + plugin only when the task matches it. +- Destructive workflows remain explicit-only and still require their concrete + plan and approval gates. +- Treat documentation and Serena memories as derived evidence, never mutation + authority. + +## Done + +- Required checks pass or are explicitly reported `NOT_PROVEN`. +- Every affected Git boundary and remote result is classified. +- No secret, private-context leak, unrelated change, or unapproved projection + drift is introduced. diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml index 7e33046..c1f1c09 100644 --- a/.gds/bundle.lock.yaml +++ b/.gds/bundle.lock.yaml @@ -5,16 +5,16 @@ bundle: version: "0.1.0-dev" release_sequence: 0 channel: "development" - source_commit: "d15c43e21fd5667ea7178ba901d92fff6c78c6e3" - digest: "sha256:9a4b1394d8e0a27f7d83ffa4859ccf99ddcbd82ec31b2cc9bc645c094ecbd761" + source_commit: "97e8bbaa3a0734b156b03bad704503bc46d7575b" + digest: "sha256:fd66beb15c847e94b68a00083df5f218c22f4e1174d39d4bd10ed7fb321b13bc" projection: - input_digest: "sha256:1b002301a66b425794042fe22fe69e8a0dc223a2c6a96d51adb9c873e9c13050" - output_digest: "sha256:de9d7ef64137f65cf26d1832d0141b4624c7d1442ad2923bda3f197f4830f448" + input_digest: "sha256:d63d8f75928f803c3de01e1bfd64c9b6886293c80c33b697f5bd39cec338d028" + output_digest: "sha256:a52549646ef45d0942228206deb3648bc51fb025a2cb8d316f6851b3aa546617" files: - path: ".claude/CLAUDE.md" - digest: "sha256:7b50d15feae7b63b94d845b2fa6e19e3220527c5b0cac69303b7fc19bd7484a8" + digest: "sha256:bd7b7a1a65dd6c3a43f8ef36fb5c52fb98df60a04f3765a426fa3b54490c4dc1" - path: ".gds/compiled-policy.json" digest: "sha256:25a729cdde19853e2f7408c31649f809c142f0889f8ca38cab1b3466649a7167" - path: "AGENTS.md" - digest: "sha256:de57ea36bb90c8376aa67490aa388a841da22d6ba5572e67f66ace533deba322" + digest: "sha256:544b1da0afeb20c49fe6734d4fe4878bc02891769ade5fc1c154f902e74da992" diff --git a/AGENTS.md b/AGENTS.md index 4eb6788..ecd4a15 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,11 +1,60 @@ -# Repository instructions + +# GDS repository contract -- Treat this clone as one independent Git mutation boundary. +## Scope + +- Repository ID: `repo_01KXEDY8XHS7RFV8KTJHDTZ8NF`. +- Roles: `module`. +- Canonical repository facts: `.gds/repository.yaml`. +- Applied bundle: `.gds/bundle.lock.yaml` (`0.1.0-dev`). +- Compiled policy: `.gds/compiled-policy.json`. + +## Boundaries + +- This Git repository is one independent mutation boundary. - Preserve unrelated branches, worktrees, submodules, and dirty changes. -- Follow the repository's local documentation and source-owned contracts. -- Keep secrets, credentials, runtime state, caches, logs, and generated evidence - out of version control. +- Resolve cross-repository work with `gds context --json` before acting. +- Generated files are projections; change their canonical inputs and regenerate. + +## Safety + +- External writes require explicit approval: `true`. +- Generated projection edits: `forbidden`. +- Private parent context persistence: `forbidden`. +- Visibility contract: `public`; data classification: `public`. -## Verification +## Development - Test: `python3 cli-tools/validate_public_contracts.py`. + +## Agent routing + +- Start here: run `gds-orient` (or `gds context --json`) to resolve scope before + any cross-repository work. It is the orientation entry point. +- Active skill profiles: `core, module`. Five profiles exist in total + (`core`, `estate-admin`, `module`, `device`, `portfolio`); only the listed ones + are active for this repository. The catalog is `skills/registry.yaml`, and each + skill lives under `skills/canonical//SKILL.md`. +- Use on-demand skills for procedures; do not duplicate them here. +- Treat docs and memories as derived evidence, not mutation authority. + +## Done + +- Required verification is complete or explicitly `NOT_PROVEN`. +- Git state and every affected repository boundary are classified. +- No private data, secret, or unapproved generated drift is introduced.