Guaranteed capabilities

Deterministic and blocking. Implemented, and a behavioural test proves it.

guaranteed 134 claims

Every platform, artifact name and installation URL is derived from one model, and a projection that disagrees with it is refused

apps/majordomus-cli/src/distribution/mod.rs · test/cases/84_distribution_model.sh
The documented one-line install command is composed from the model's parts, and a document that states a different one fails the suite

apps/majordomus-cli/src/distribution/mod.rs · test/cases/84_distribution_model.sh
The installer verifies an artifact's digest and inspects its archive before anything is unpacked, and any failure leaves the previous installation working

share/install/install.sh.in · test/cases/85_installer.sh
A release publishes an artifact for every supported target or it is not published

scripts/release-record · test/cases/87_release_pipeline.sh
The install command this project advertises is fetched and run from the published site on every push to the default branch, and the branch is red while it does not install a working tool

scripts/ci/install-check · test/cases/97_install_gate.sh
A release archive carries every path once and carries nothing but files and directories

scripts/release-package · test/cases/87b_release_archive_shape.sh
The canonical policy is parsed and rejected if it contains an unknown key

lib/common.sh · test/cases/00_yaml_flatten.sh
Every profile is parsed, its unknown keys rejected, and the default profile proven to exist

lib/doctor.sh · test/cases/02_doctor_basic.sh
Every enforcement the policy declares is reconciled against what actually runs

lib/doctor.sh · test/cases/03_update.sh
Exit codes are a contract, and no code means "warn and continue"

lib/common.sh · test/cases/03_update.sh
Provider instruction files are generated from the one policy, deterministically

lib/update.sh · test/cases/03_update.sh
Every generated instruction file carries its own stamp, and a hand edit is detected

lib/update.sh · test/cases/03_update.sh
A projection can own only the region between its markers, leaving the rest of the file untouched

lib/update.sh · test/cases/13_region_projection.sh
Wiring is found in a hook or in any subhook of the directory that hook dispatches to

lib/doctor.sh · test/cases/14_wiring_dispatcher.sh
Every rule the tool enforces is declared once, as a rule object in the repository's effective set, and doctor proves each one is reached by the command that claims to run it

lib/doctrine.sh · test/cases/18_doctrine_wiring.sh
A doctrine's class is what decides whether a violation stops the command, not a label beside it

lib/doctrine.sh · test/cases/17_doctrine_enforcement.sh
Every line of the append-only ledger is a well-formed event, and a malformed line is a failure rather than a skipped record

lib/check.sh · test/cases/22_history.sh
An entry in the questions store that does not parse blocks acceptance exactly as an unresolved question does

lib/check.sh · test/cases/21_decision_question.sh
A declared provider hook captures the person's raw prompts below the model, and doctor proves it by running it

lib/capture.sh · test/cases/29_prompt_capture.sh
Every repository-local prompt asset renders, and an unknown token is a failure

lib/prompt.sh · test/cases/24_prompt_search.sh
A use case or application cannot name a command, doctrine or claim that does not exist, and the two catalogues cannot disagree about which applies to which

lib/usecase.sh · test/cases/28_catalogue.sh
A hand-edited instruction file is never silently overwritten

lib/update.sh · test/cases/03_update.sh
The always-loaded instruction file has a line budget with a failing check

lib/update.sh · test/cases/03_update.sh
Every repository-relative reference in the always-loaded file is proven to resolve

lib/doctor.sh · test/cases/03_update.sh
A hardcoded count in the always-loaded file is a failure

lib/doctor.sh · test/cases/03_update.sh
The append-only ledger and handover store have retention caps that are checked

lib/doctor.sh · test/cases/02_doctor_basic.sh
Installing into a repository that already has an installation is refused

lib/init.sh · test/cases/01_init.sh
Every finding carries the command that reproduces it

lib/common.sh · test/cases/02_doctor_basic.sh
Nothing performs a network call, evaluates generated text, or deletes recursively

bin/majordomus · test/cases/08_no_forbidden_constructs.sh
A task is started with a declared file scope and a profile, and only one task is active per checkout

lib/start.sh · test/cases/04_start_check.sh
Identity fields on every state record are computed from git and never authored

lib/start.sh · test/cases/04_start_check.sh
check reports whether state, scope, blockers and checkpoint age are consistent right now

lib/check.sh · test/cases/04_start_check.sh
A touched file outside the claimed scope is a failure, not a warning

lib/check.sh · test/cases/04_start_check.sh
State read back is labelled exact, advanced, diverged or different_context against git

lib/common.sh · test/cases/04_start_check.sh
Overlap between parallel workers is computed on claimed paths in both containment directions

lib/check.sh · test/cases/04_start_check.sh
watch reports policy, projection, state, scope, handover, verification, staleness and retention drift

lib/watch.sh · test/cases/07_watch.sh
handover writes an append-only record with computed front matter and required sections

lib/handover.sh · test/cases/05_handover.sh
Handovers carry durable facts, never conversation transcripts

lib/handover.sh · test/cases/05_handover.sh
finish evaluates the finish contract line by line and refuses when any line is unmet

lib/finish.sh · test/cases/06_finish.sh
An outcome is a value from a closed vocabulary, not free text

lib/finish.sh · test/cases/06_finish.sh
The context a worker is given is assembled from durable state in authority order, and what a profile excludes is excluded

lib/context.sh · test/cases/23_context.sh
The assembled context obeys a line budget, and every section it drops is named with its reason

lib/context.sh · test/cases/23_context.sh
A checkpoint is a capped progress record with computed identity, and a body over the cap is refused rather than truncated

lib/checkpoint.sh · test/cases/20_checkpoint.sh
The right prior record is resolved by worktree and branch, and an unrelated one is never offered

lib/common.sh · test/cases/23_context.sh
The ledger is readable back as operational history, filtered by task, event and time

lib/history.sh · test/cases/22_history.sh
Rotating the ledger archives the oldest lines and never deletes them

lib/history.sh · test/cases/22_history.sh
A decision is recorded with its reason and its task, and is superseded by a later entry rather than edited

lib/decision.sh · test/cases/21_decision_question.sh
An unresolved question blocks acceptance, and an entry the gate cannot parse is a failure rather than a silent pass

lib/question.sh · test/cases/21_decision_question.sh
A repository-local prompt renders against a closed set of state tokens, and an unknown token is an error

lib/prompt.sh · test/cases/24_prompt_search.sh
Durable records are searchable literally, across kinds, without an index

lib/search.sh · test/cases/24_prompt_search.sh
Every continuity store is proven reachable through its own command, not merely present on disk

lib/doctor.sh · test/cases/25_continuity_lifecycle.sh
The context that applies to a path is composed from the layer's scoped documents, root to target, in one deterministic order with provenance, and a tree that does not validate resolves nothing

lib/context_docs.sh · test/cases/69_context_documents.sh
Every directory of the layer carries a context document, the exemption is declared by the contract that governs the subtree, and a descendant may narrow that requirement but never weaken it

lib/context_docs.sh · test/cases/69_context_documents.sh
The impact of a change set on the scoped context is reported from git — the documents, the scopes below them, moves with their ancestry, tracked sources to review, and stale projections — and an unrelated change reports nothing

lib/context_docs.sh · test/cases/70_context_impact.sh
The repository's AI layer is one directory whose manifest names every section, readable without the tool

lib/init.sh · test/cases/01_init.sh
Checkout-local state lives under .ai/local/, is ignored by git, and is absent on a fresh clone or worktree

lib/common.sh · test/cases/01_init.sh
The rule baseline is vendored into the repository with a manifest naming every file and its hash, and a hand edit is detected and refused

lib/rules.sh · test/cases/67_rule_dag.sh
The effective rule set is resolved as a dependency graph in a deterministic order, and a set that does not resolve is applied by nothing

lib/rules.sh · test/cases/67_rule_dag.sh
Provider instruction files are thin bootstraps that point at the AI layer and carry no rule of their own

lib/update.sh · test/cases/03_update.sh
A repository on the pre-.ai layout is migrated once, explicitly, with a previewed plan and a verified backup of its local state, and the command is idempotent afterwards

lib/migrate.sh · test/cases/66_migrate_legacy.sh
The tool runs read-only from any location, and two locations of one version agree about one repository

lib/common.sh · test/cases/65_tool_root_independence.sh
What the tool knows about itself is written once and derived everywhere else, and a second copy is a test failure

lib/doctor.sh · test/cases/28_no_hardcoded_values.sh
The public command surface is declared, and reconciled against the dispatcher

share/commands.yaml · test/cases/30_command_registry.sh
Every public command has a behavioural test and a negative test, computed rather than remembered

test/cases/31_command_coverage.sh · test/cases/31_command_coverage.sh
The ledger's event vocabulary is closed, on the way in and on the way out

lib/common.sh · test/cases/33_event_registry.sh
A task record names the checkout it belongs to, and another checkout is never held to its scope

lib/check.sh · test/cases/27_foreign_task.sh
A blocking question keeps blocking after the work is handed to a new task

lib/check.sh · test/cases/50_blocker_across_handover.sh
Milestones and issues are canonical repository files, and a key nobody reads is an error

lib/project.sh · test/cases/40_project_model.sh
Issue and milestone status is derived from recorded facts and is stored nowhere

lib/project.awk · test/cases/41_project_status.sh
A cycle, a self-dependency and a dependency on an issue that does not exist are each refused by name

lib/project.awk · test/cases/42_dag_waves.sh
Execution waves are computed from the graph, and issues in one wave that touch the same paths are reported as serialised

lib/project.awk · test/cases/42_dag_waves.sh
An issue cannot be completed while a required piece of evidence is missing

lib/plan.sh · test/cases/41_project_status.sh
The roadmap is derived from milestone state, and no document may be a second authority for it

lib/doctor.sh · test/cases/49_roadmap_doctrine.sh
GitHub milestones and issues are generated from the canonical model, and a hand-edited generated region is reported rather than overwritten

scripts/github-sync · test/cases/45_github_projection.sh
A projection that stops being applied turns a build red, and a gate that cannot reach GitHub reports that it cannot rather than passing

scripts/ci/github-check · test/cases/97_github_gate.sh
The Rust executable serves the repository's AI layer to an MCP client over stdio, read-only, with protocol frames alone on stdout

apps/majordomus-cli/src/mcp/protocol.rs · test/cases/72_rust_mcp.sh
What the MCP server serves is decided by the manifest, the declared source classes and each file's front matter, so an object added to the layer is served with no change to the executable

apps/majordomus-cli/src/index.rs · test/cases/72_rust_mcp.sh
A file of the layer the MCP server cannot read is excluded with a diagnostic naming its path and the index says it is degraded, never silently smaller

apps/majordomus-cli/src/index.rs · test/cases/72_rust_mcp.sh
Every capability of the Rust executable is defined once, and the registry refuses a duplicate id or a colliding projection name, naming both parties

apps/majordomus-cli/src/capability/registry.rs · test/cases/76_capabilities_projections.sh
MCP, HTTP, OpenAPI, Swagger UI, the capabilities commands and the generated reference are derived from the registry, and a change to one definition reaches every one of them

apps/majordomus-cli/src/http/openapi.rs · test/cases/76_capabilities_projections.sh
How each declarative kind is read and which keys it may carry is data read at run time, and a repository adds a kind with its JSON Schema without a code change

apps/majordomus-cli/src/metadata/mod.rs · test/cases/76_capabilities_projections.sh
Every generated artifact declares the document it projects, the encoding it is written in, the schema its content satisfies and its source, and a structured document is written in every encoding it is committed in from one value

apps/majordomus-cli/src/generate.rs · test/cases/52_generated_artifact_typing.sh
The committed projections, the OpenAPI document, the capability reference and the allow-lists, are regenerated from the registry and the schemas, and generate --check refuses a stale one

apps/majordomus-cli/src/generate.rs · test/cases/76_capabilities_projections.sh
One shared server serves a repository: the first majordomus mcp binds loopback HTTP with Swagger UI and MCP over HTTP beside its stdio session and logs the URL, every later one attaches to it, and it ends when the last client leaves

apps/majordomus-cli/src/lease.rs · test/cases/90_mcp_shared_server.sh
Nothing a client leaves behind locks another client out of the shared server; a corrupt, empty, stale or abandoned lease is taken over and named, a client that cannot share is served alone with the reason logged, and a signal removes the lease before the server dies

apps/majordomus-cli/src/lease.rs · test/cases/90_mcp_shared_server.sh
Every client attached to the shared server is a peer named by its own initialize, listed by majordomus_peers, and majordomus_announce tells the others what it is working on and which paths it expects to touch

apps/majordomus-cli/src/peers.rs · test/cases/90_mcp_shared_server.sh
An MCP client opened in the repository starts the server itself, building the executable when it must, through the client configurations at the root and bin/majordomus-mcp

bin/majordomus-mcp · test/cases/90_mcp_shared_server.sh
A majordomus:// URI resolves the same way through the MCP resource read, the majordomus_get tool and the HTTP object route, and majordomus://repository answers repository.info as a JSON document tagged builtin

apps/majordomus-cli/src/capability/builtin/objects.rs · test/cases/72_rust_mcp.sh
Every gate the Rust executable must pass is one script, scripts/rust-check, and CI runs that script on every change that can reach the crate

scripts/rust-check · test/cases/77_rust_evidence.sh
Line coverage of the Rust crate is measured on every change that can affect the crate and on every push to master, and the build fails under the floor in scripts/rust-coverage-threshold, one integer read by CI, by scripts/rust-check and by just coverage

.github/workflows/validate.yml · test/cases/77_rust_evidence.sh
The paths of the Rust executable that scale with the repository carry criterion benchmarks that build on every push, and every executable capability declares its benchmark policy, required or waived for a typed reason

apps/majordomus-cli/benches/projections.rs · test/cases/77_rust_evidence.sh
A capability of the Rust executable is declared once and composed into its module, the root composes modules, and the registry refuses a capability outside its module's namespace

apps/majordomus-cli/src/capability/module.rs · test/cases/91_canonical_architecture.sh
Every externally callable operation of the Rust executable is a benchmark target with a denominator generated from the registry, and a missing case fails the structural check

apps/majordomus-cli/src/bench/coverage.rs · test/cases/91_canonical_architecture.sh
After startup, no MCP or HTTP request of the Rust executable scans the repository, builds the index or the registry, derives a schema or builds a projection, and perf.counters proves it

apps/majordomus-cli/src/perf.rs · test/cases/91_canonical_architecture.sh
A cached capability of the Rust executable answers the same value uncached, cold and warm, a hit runs no handler, errors and commands are never cached, and the key carries the registry fingerprint

apps/majordomus-cli/src/capability/executor.rs · test/cases/91_canonical_architecture.sh
The provider bootstraps the policy declares (AGENTS.md, CLAUDE.md, GEMINI.md, ...) are a target of majordomus generate, rendered from the policy and the provider templates byte for byte as the shell tool renders them, and generate --check refuses a hand-edited or stale one in CI

apps/majordomus-cli/src/providers.rs · test/cases/93_rust_provider_projections.sh
The site's Registry page is rendered from site/data/registry/registry.json, a dataset majordomus generate site derives from the registry and the index with their fingerprints, and generate --check refuses a stale one in CI

apps/majordomus-cli/src/site.rs · apps/majordomus-cli/tests/projections.rs
A change runs the gates its paths can affect, decided by one model of what affects what, and a change to the pipeline itself or a path the model does not know runs every gate

scripts/ci-plan · test/cases/94_ci_plan.sh
The one status a branch rule requires is green only when planning succeeded and every gate the plan selected ran in a job that succeeded; a failed or cancelled job, a selected gate whose job was skipped, or a plan that selected nothing is red

scripts/ci/verdict · test/cases/94_ci_plan.sh
The behavioural suite runs a bounded number of cases at a time with the serial runner's semantics, a case that writes into the checkout declares itself exclusive and runs alone, and the parallel phase fails naming the paths when the checkout changed under it

test/run.sh · test/cases/94_ci_plan.sh
The Rust executable the rust gate built is published as an artifact with its provenance, and every Rust case drives the executable MAJORDOMUS_BIN names instead of building one

scripts/rust-check · test/cases/94_ci_plan.sh
Publication is gated on everything that can make the published site wrong and waits for nothing else; the checks that decide whether a change may merge run beside it on the same commit, not in front of it

.github/workflows/pages.yml · test/cases/97_pages_fast_path.sh
The OpenAPI document is inferred, the tags are the modules, the examples are the benchmark cases, the responses are the router's statuses by kind, the prose is the one text every projection shares, and the site's API reference is rendered from the committed document

apps/majordomus-cli/src/http/openapi.rs · test/cases/92_openapi_reference.sh
What a worker reads of the repository is declared once in .ai/repo/scope.yaml, out wins over in, and the Rust executable discovers, indexes and serves nothing outside it

apps/majordomus-cli/src/scope.rs · test/cases/93_scope_policy.sh
Every public command is named and run by an active use case, a guaranteed claim or an MCP tool without one is a named gap, and the policy says which gaps fail doctor, check and finish

lib/usecase.sh · test/cases/94_use_cases.sh
A use case's scenario executes against the real tool in a disposable repository, every step's exit code and output are asserted, and the normalised evidence is what the site shows

lib/usecase.sh · test/cases/94_use_cases.sh
From the files a change touched, the tool names the commands, rules, use cases, scenarios and behavioural cases affected, and scaffolds a draft for a capability no use case covers

lib/usecase.sh · test/cases/94_use_cases.sh
The site is deployed by one script, scripts/site-deploy, from a terminal or from the publication workflow; it refuses a dirty tree, a commit master does not contain and a build that is not HEAD's, pushes site/public to gh-pages with the source commit named, and pushes nothing when the output is unchanged

scripts/site-deploy · test/cases/96_site_deploy.sh
A commit whose derived data is behind its canonical inputs is refused before it exists, and a repository that unwires that gate is a doctor failure

scripts/pages · test/cases/56_derived_current_gate.sh
The site's pages about the Rust executable (one per module, one per capability, the command line, the MCP surface, the benchmarks, the executable's own narrative) are derived from the registry manifest and the registry dataset the executable generates, nothing names a capability by hand, and a capability that joins or leaves the registry gains or loses its page, its index entries and its links from the generators alone

scripts/lib/executable-site.jq · test/cases/95_executable_reference.sh
Every committed derived artifact of the repository is regenerated by one command in dependency order and checked by one read-only command that names every stale artifact, a second regeneration on a clean tree changes nothing, and no derived file records the commit it lands in

scripts/derive · test/cases/51_derived_artifacts_committed.sh
A skill is one directory under the layer's skills section holding SKILL.md, discovered by the source class `skill` the shell tool and the Rust executable both read, so that adding the file is the whole registration and the catalogue, the command, doctor, MCP and the site all derive from it

lib/skills.sh · test/cases/95_skills.sh
A task that declares obligations reaches the outcome completed only when each one has evidence recorded against it, and evidence taken over files that have since changed, or at a commit the branch has since left, no longer discharges anything

lib/evidence.sh · test/cases/103_obligations.sh
An obligation whose fact the tool can hold is established live rather than recorded — a clean tree, a remote-tracking ref that reaches the head, a trunk that reaches it, a published site that serves it — and a hand-recorded line neither discharges it nor rescues it

lib/evidence.sh · test/cases/103_obligations.sh
Every skill is validated against the allow-list generated from its schema, its directory, its sections and its references, a violation names the file and every reason, and a repository with no skills is reported rather than passed

lib/skills.sh · test/cases/95_skills.sh
The website's skills section is rendered from the skills catalogue, one page per skill carrying the skill's own body and examples, and a removed or renamed skill leaves no page, entry or link behind

scripts/generate-site-data · test/cases/95_skills.sh
An operational moment is one file under the layer, discovered rather than registered, and answered by the command line, the HTTP API, the OpenAPI document, MCP, the derived graph and the website with nothing else changed

apps/majordomus-cli/src/why.rs · test/cases/98_why_catalogue.sh
Every reference a moment makes resolves against the thing it names, and one that does not is an error carrying the nearest candidate

apps/majordomus-cli/src/why.rs · apps/majordomus-cli/tests/why.rs
A diagnosis of a reader's own symptoms is deterministic counting over the catalogue's metadata, and every recommendation names the moments that produced it

apps/majordomus-cli/src/why.rs · apps/majordomus-cli/tests/why.rs
A closed execution episode is a shared object of the layer, written by the tool from git and the ledger, valid against a contract that admits no conversation and no absolute path, and discovered rather than registered

lib/session.sh · test/cases/63_session_records.sh
A provider hook opens the episode below the model and hands the worker what the last one left, records what a compaction is about to discard, and closes the episode with a continuation record beside its envelope

lib/session_context.sh · test/cases/54_session_lifecycle_hooks.sh
An architecture decision is one file under the layer's adrs section, validated against the decision contract, with an identity nothing else claims, reciprocal supersession, and every reference it makes resolving

lib/adr.sh · test/cases/99_adr.sh
A decision states what it put in force as typed references, each one validated, and the reverse direction — what a rule, a document, an implementation or a case was decided by — is read from the knowledge graph rather than written down a second time

lib/adr.sh · test/cases/99_adr.sh
majordomus adr propose writes a decision with status proposed and refuses to write any other status, allocates its identity under a lock so concurrent workers never collide, and records what the decision was derived from

lib/adr.sh · test/cases/99_adr.sh
Every command of the Rust executable's command line carries a summary, a long description, help on every argument and at least one example, and every example shown to a reader is executed against the built executable

apps/majordomus-cli/src/cli.rs · apps/majordomus-cli/tests/cli_docs.rs
Every web surface is declared once at its producer and resolved into one topology, from which the router, the landing page and the machine-readable index are each projected

apps/majordomus-cli/src/web/model.rs · test/cases/89_web_surface.sh
/docs serves this repository's documentation and /swagger serves the Swagger UI, and neither may take the other's mount

apps/majordomus-cli/src/web/discover.rs · test/cases/89_web_surface.sh
A branch's worktree path is derived from git identity and the branch name alone — the primary checkout's sibling named with -wt, then the branch with its hierarchy kept — and is the same answer from every directory of every worktree, with nothing registered or configured

apps/majordomus-cli/src/worktree/path.rs · test/cases/96_worktree_topology.sh
A misplaced worktree is brought to its canonical path with its modified, staged, unstaged and untracked work intact, verified by a fingerprint taken before and after the move, and a step is reported as moved only when the two are equal

apps/majordomus-cli/src/worktree/migrate.rs · test/cases/96_worktree_topology.sh
A product feature is one file under the layer, discovered rather than registered, and answered by the command line, the HTTP API, the OpenAPI document, MCP, the derived graph, the capability matrix and the website's homepage and feature pages with nothing else changed

apps/majordomus-cli/src/product.rs · test/cases/97_product_features.sh
Which interfaces a feature is exposed through, what stands behind it and what it answers are derived from the registries that own those facts, never authored, and a source file that writes one down is refused by its schema

apps/majordomus-cli/src/product.rs · apps/majordomus-cli/tests/product.rs
Every reference a feature makes resolves against the registry that owns it, and one that does not is an error naming the file, the key and the nearest candidate rather than a page linking to nothing

apps/majordomus-cli/src/product.rs · apps/majordomus-cli/tests/product.rs
The dataset the website is rendered from carries only fields an allow-list names, so a feature's prose, a machine path or a field nobody allowed cannot reach a published page

apps/majordomus-cli/src/site.rs · apps/majordomus-cli/tests/product.rs
The website's homepage and feature pages name no feature, module, command, provider or count of their own, and a stale product dataset fails the build before it can be deployed

site/templates/index.html · test/cases/12_site_build.sh

← The full matrix

Guaranteed capabilities

Every platform, artifact name and installation URL is derived from one model, and a projection that disagrees with it is refused

The documented one-line install command is composed from the model's parts, and a document that states a different one fails the suite

The installer verifies an artifact's digest and inspects its archive before anything is unpacked, and any failure leaves the previous installation working

A release publishes an artifact for every supported target or it is not published

The install command this project advertises is fetched and run from the published site on every push to the default branch, and the branch is red while it does not install a working tool

A release archive carries every path once and carries nothing but files and directories

The canonical policy is parsed and rejected if it contains an unknown key

Every profile is parsed, its unknown keys rejected, and the default profile proven to exist

Every enforcement the policy declares is reconciled against what actually runs

Exit codes are a contract, and no code means "warn and continue"

Provider instruction files are generated from the one policy, deterministically

Every generated instruction file carries its own stamp, and a hand edit is detected

A projection can own only the region between its markers, leaving the rest of the file untouched

Wiring is found in a hook or in any subhook of the directory that hook dispatches to

Every rule the tool enforces is declared once, as a rule object in the repository's effective set, and doctor proves each one is reached by the command that claims to run it

A doctrine's class is what decides whether a violation stops the command, not a label beside it

Every line of the append-only ledger is a well-formed event, and a malformed line is a failure rather than a skipped record

An entry in the questions store that does not parse blocks acceptance exactly as an unresolved question does

A declared provider hook captures the person's raw prompts below the model, and doctor proves it by running it

Every repository-local prompt asset renders, and an unknown token is a failure

A use case or application cannot name a command, doctrine or claim that does not exist, and the two catalogues cannot disagree about which applies to which

A hand-edited instruction file is never silently overwritten

The always-loaded instruction file has a line budget with a failing check

Every repository-relative reference in the always-loaded file is proven to resolve

A hardcoded count in the always-loaded file is a failure

The append-only ledger and handover store have retention caps that are checked

Installing into a repository that already has an installation is refused

Every finding carries the command that reproduces it

Nothing performs a network call, evaluates generated text, or deletes recursively

A task is started with a declared file scope and a profile, and only one task is active per checkout

Identity fields on every state record are computed from git and never authored

check reports whether state, scope, blockers and checkpoint age are consistent right now

A touched file outside the claimed scope is a failure, not a warning

State read back is labelled exact, advanced, diverged or different_context against git

Overlap between parallel workers is computed on claimed paths in both containment directions

watch reports policy, projection, state, scope, handover, verification, staleness and retention drift

handover writes an append-only record with computed front matter and required sections

Handovers carry durable facts, never conversation transcripts

finish evaluates the finish contract line by line and refuses when any line is unmet

An outcome is a value from a closed vocabulary, not free text

The context a worker is given is assembled from durable state in authority order, and what a profile excludes is excluded

The assembled context obeys a line budget, and every section it drops is named with its reason

A checkpoint is a capped progress record with computed identity, and a body over the cap is refused rather than truncated

The right prior record is resolved by worktree and branch, and an unrelated one is never offered

The ledger is readable back as operational history, filtered by task, event and time

Rotating the ledger archives the oldest lines and never deletes them

A decision is recorded with its reason and its task, and is superseded by a later entry rather than edited

An unresolved question blocks acceptance, and an entry the gate cannot parse is a failure rather than a silent pass

A repository-local prompt renders against a closed set of state tokens, and an unknown token is an error

Durable records are searchable literally, across kinds, without an index

Every continuity store is proven reachable through its own command, not merely present on disk

The context that applies to a path is composed from the layer's scoped documents, root to target, in one deterministic order with provenance, and a tree that does not validate resolves nothing

Every directory of the layer carries a context document, the exemption is declared by the contract that governs the subtree, and a descendant may narrow that requirement but never weaken it

The impact of a change set on the scoped context is reported from git — the documents, the scopes below them, moves with their ancestry, tracked sources to review, and stale projections — and an unrelated change reports nothing

The repository's AI layer is one directory whose manifest names every section, readable without the tool

Checkout-local state lives under .ai/local/, is ignored by git, and is absent on a fresh clone or worktree

The rule baseline is vendored into the repository with a manifest naming every file and its hash, and a hand edit is detected and refused

The effective rule set is resolved as a dependency graph in a deterministic order, and a set that does not resolve is applied by nothing

Provider instruction files are thin bootstraps that point at the AI layer and carry no rule of their own

A repository on the pre-.ai layout is migrated once, explicitly, with a previewed plan and a verified backup of its local state, and the command is idempotent afterwards

The tool runs read-only from any location, and two locations of one version agree about one repository

What the tool knows about itself is written once and derived everywhere else, and a second copy is a test failure

The public command surface is declared, and reconciled against the dispatcher

Every public command has a behavioural test and a negative test, computed rather than remembered

The ledger's event vocabulary is closed, on the way in and on the way out

A task record names the checkout it belongs to, and another checkout is never held to its scope

A blocking question keeps blocking after the work is handed to a new task

Milestones and issues are canonical repository files, and a key nobody reads is an error

Issue and milestone status is derived from recorded facts and is stored nowhere

A cycle, a self-dependency and a dependency on an issue that does not exist are each refused by name

Execution waves are computed from the graph, and issues in one wave that touch the same paths are reported as serialised

An issue cannot be completed while a required piece of evidence is missing

The roadmap is derived from milestone state, and no document may be a second authority for it

GitHub milestones and issues are generated from the canonical model, and a hand-edited generated region is reported rather than overwritten

A projection that stops being applied turns a build red, and a gate that cannot reach GitHub reports that it cannot rather than passing

The Rust executable serves the repository's AI layer to an MCP client over stdio, read-only, with protocol frames alone on stdout

What the MCP server serves is decided by the manifest, the declared source classes and each file's front matter, so an object added to the layer is served with no change to the executable

A file of the layer the MCP server cannot read is excluded with a diagnostic naming its path and the index says it is degraded, never silently smaller

Every capability of the Rust executable is defined once, and the registry refuses a duplicate id or a colliding projection name, naming both parties