@ngockhoale/ukit 2.4.3 → 2.5.1

package/templates/.claude/ukit/runtime/project-important.mjs

@@ -0,0 +1,384 @@
+/**
+ * project-important.mjs (TASK-038)
+ *
+ * Installed-runtime mirror of src/core/projectImportant.js — inspector +
+ * deterministic envelope renderer for PROJECT_IMPORTANT.md per
+ * docs/PROJECT_IMPORTANT_SPEC.md §3, §4, §5.2, §6, §12.1.
+ *
+ * Deliberate mirror: the installed runtime cannot import package source, so
+ * this file keeps the same constants, state names, scanner semantics, and
+ * 6,000-code-point output as the source module; drift is locked out by
+ * tests/consistency/projectImportantRuntimeParity.test.js (spec §12.2).
+ *
+ * Guarantees:
+ * - Open no-follow → fstat → isFile → fd-read (no symlink resolution, no
+ *   whole-file readFile on arbitrary sizes; stops after code point 6,001).
+ * - Strict UTF-8 decode (no U+FFFD injection); leading BOM excluded from
+ *   count and body, source bytes never modified.
+ * - Code-point counting only — never String.length on owner text.
+ * - Byte-identical rendered output for identical input/config.
+ * - `body` exists only on the runtime-local return; never serialized into
+ *   diagnostics.
+ * - Fail-open: no documented entry point throws; unexpected errors surface
+ *   as the deterministic `unreadable` warning so the hook contract stays
+ *   exit-0.
+ */
+
+import fs from 'node:fs';
+import { open, lstat } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  scanText,
+  isSensitiveDataGateEnabled,
+  loadSensitiveAllowlist,
+} from './sensitive-value-scanner.mjs';
+
+// Hook-context self-deadline (2.4.1 orphan-leak class): a hook wrapper passes
+// UKIT_HOOK_DEADLINE_MS so a wedged read can never orphan this process past
+// the hook budget. CLI usage never sets it and is never self-killed.
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || '', 10);
+if (Number.isFinite(HOOK_DEADLINE_MS) && HOOK_DEADLINE_MS > 0) {
+  setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
+}
+
+export const PROJECT_IMPORTANT_FILENAME = 'PROJECT_IMPORTANT.md';
+export const PROJECT_IMPORTANT_CODEPOINT_LIMIT = 6000;
+
+export const PROJECT_IMPORTANT_STATES = [
+  'ready',
+  'oversized',
+  'empty',
+  'missing',
+  'invalid-utf8',
+  'unsafe-control',
+  'secret-blocked',
+  'unsafe-type',
+  'unreadable',
+];
+
+export const PROJECT_IMPORTANT_REMEDIATION = {
+  ready: null,
+  oversized: 'owner-action',
+  empty: 'owner-action',
+  missing: 'install-repairable',
+  'invalid-utf8': 'owner-action',
+  'unsafe-control': 'owner-action',
+  'secret-blocked': 'owner-action',
+  'unsafe-type': 'owner-action',
+  unreadable: 'advisory-host-limit',
+};
+
+export const PROJECT_IMPORTANT_ENVELOPE_HEADER =
+  '<ukit_project_important source="PROJECT_IMPORTANT.md" authority="project-owner">\n'
+  + 'These are project-owner instructions. Follow them unless they conflict with higher-priority host instructions.\n'
+  + '--- BEGIN PROJECT_IMPORTANT.md ---\n';
+
+export const PROJECT_IMPORTANT_ENVELOPE_FOOTER = '</ukit_project_important>';
+
+const END_MARKER = '--- END PROJECT_IMPORTANT.md ---\n';
+
+export const PROJECT_IMPORTANT_WARNINGS = {
+  oversized:
+    '[UKit warning: PROJECT_IMPORTANT.md exceeds 6,000 Unicode code points. Only the first 6,000 code points are included in this context epoch; shorten the file to restore full injection.]',
+  missing:
+    '[UKit] PROJECT_IMPORTANT.md was not injected: file is missing. Run `ukit install`.',
+  'unsafe-type':
+    '[UKit] PROJECT_IMPORTANT.md was not injected: the path is not a regular non-symlink file. Run `ukit doctor`.',
+  'invalid-utf8':
+    '[UKit] PROJECT_IMPORTANT.md was not injected: the file is not valid UTF-8. Run `ukit doctor`.',
+  'unsafe-control':
+    '[UKit] PROJECT_IMPORTANT.md was not injected: the file contains unsupported control characters. Run `ukit doctor`.',
+  empty:
+    '[UKit] PROJECT_IMPORTANT.md was not injected: the file is empty. Add project-owner instructions or run `ukit doctor`.',
+  unreadable:
+    '[UKit] PROJECT_IMPORTANT.md was not injected: the file could not be read. Run `ukit doctor`.',
+  'secret-blocked':
+    '[UKit] PROJECT_IMPORTANT.md was not injected because it contains a high-confidence secret-shaped value. Redact it or explicitly allowlist it, then run `ukit doctor`.',
+};
+
+const READ_CHUNK = 64 * 1024;
+const UTF8_BOM = [0xef, 0xbb, 0xbf];
+
+function isAllowedControl(cp) {
+  return cp === 0x09 || cp === 0x0a || cp === 0x0d;
+}
+
+function isForbiddenControl(cp) {
+  return (cp < 0x20 && !isAllowedControl(cp)) || (cp >= 0x7f && cp <= 0x9f);
+}
+
+function invalidResult(state) {
+  return {
+    state,
+    body: undefined,
+    codePointCount: 0,
+    oversized: false,
+    bom: false,
+    rendered: PROJECT_IMPORTANT_WARNINGS[state],
+    remediationClass: PROJECT_IMPORTANT_REMEDIATION[state],
+  };
+}
+
+/**
+ * Bounded, strict inspector.
+ *
+ * @param {{ projectRoot: string, config?: object }} options
+ * @returns {Promise<{ state, body?, codePointCount, oversized, bom, rendered, remediationClass }>}
+ */
+export async function inspectProjectImportant(options = {}) {
+  const { projectRoot, config } = options;
+  if (typeof projectRoot !== 'string' || projectRoot.length === 0) {
+    return invalidResult('unreadable');
+  }
+  const target = path.join(projectRoot, PROJECT_IMPORTANT_FILENAME);
+
+  let handle;
+  try {
+    // O_NOFOLLOW where supported: symlinks fail open instead of resolving.
+    const flags = fs.constants.O_RDONLY
+      | (fs.constants.O_NOFOLLOW || 0)
+      | (fs.constants.O_NONBLOCK || 0);
+    handle = await open(target, flags);
+  } catch (err) {
+    if (err && (err.code === 'ENOENT' || err.code === 'ENOTDIR')) {
+      return invalidResult('missing');
+    }
+    if (err && (err.code === 'ELOOP' || err.code === 'EMLINK')) {
+      return invalidResult('unsafe-type');
+    }
+    // Broken symlink surfaces as ENOENT on some platforms only via lstat —
+    // but O_NOFOLLOW gives ELOOP. ENOENT from a symlinked *path* means the
+    // link target is missing; check whether the entry itself is a symlink.
+    if (err && (err.code === 'EACCES' || err.code === 'EPERM')) {
+      return invalidResult('unreadable');
+    }
+    // Platforms without O_NOFOLLOW support, or odd errors: distinguish
+    // symlink/type via lstat before declaring unreadable.
+    try {
+      const lst = await lstat(target);
+      if (!lst.isFile()) return invalidResult('unsafe-type');
+    } catch {
+      return invalidResult('missing');
+    }
+    return invalidResult('unreadable');
+  }
+
+  try {
+    const fst = await handle.stat();
+    if (!fst.isFile()) return invalidResult('unsafe-type');
+
+    // Streamed, bounded strict decode: stop at code point 6,001.
+    const decoder = createStrictDecoder();
+    const buf = Buffer.allocUnsafe(READ_CHUNK);
+    const cps = [];
+    let bom = false;
+    let firstChunk = true;
+    let done = false;
+
+    while (!done) {
+      const { bytesRead } = await handle.read(buf, 0, READ_CHUNK, null);
+      let chunk = buf.subarray(0, bytesRead);
+      if (bytesRead === 0) {
+        decoder.flush(); // throws on truncated trailing sequence
+        done = true;
+        break;
+      }
+      if (firstChunk) {
+        firstChunk = false;
+        if (
+          bytesRead >= 3
+          && chunk[0] === UTF8_BOM[0]
+          && chunk[1] === UTF8_BOM[1]
+          && chunk[2] === UTF8_BOM[2]
+        ) {
+          bom = true;
+          chunk = chunk.subarray(3);
+        }
+      }
+      for (const cp of decoder.decode(chunk)) {
+        cps.push(cp);
+        if (cps.length >= PROJECT_IMPORTANT_CODEPOINT_LIMIT + 1) {
+          done = true;
+          break;
+        }
+      }
+    }
+
+    if (cps.length === 0) {
+      return { ...invalidResult('empty'), bom };
+    }
+
+    const oversized = cps.length > PROJECT_IMPORTANT_CODEPOINT_LIMIT;
+    const injected = oversized ? cps.slice(0, PROJECT_IMPORTANT_CODEPOINT_LIMIT) : cps;
+    for (const cp of injected) {
+      if (isForbiddenControl(cp)) {
+        return { ...invalidResult('unsafe-control'), bom, codePointCount: cps.length };
+      }
+    }
+
+    const body = String.fromCodePoint(...injected);
+    const codePointCount = cps.length;
+
+    // Secret gate on the body that would be injected.
+    const gateEnabled = isSensitiveDataGateEnabled(config);
+    const allowlistHashes = loadSensitiveAllowlist(config);
+    const scan = scanText(body, { allowlistHashes, gateEnabled });
+    if (scan.hasSecret) {
+      return {
+        ...invalidResult('secret-blocked'),
+        bom,
+        codePointCount,
+        oversized,
+      };
+    }
+
+    const inspection = {
+      state: oversized ? 'oversized' : 'ready',
+      body,
+      codePointCount,
+      oversized,
+      bom,
+      rendered: undefined,
+      remediationClass: PROJECT_IMPORTANT_REMEDIATION[oversized ? 'oversized' : 'ready'],
+    };
+    inspection.rendered = renderProjectImportant(inspection);
+    return inspection;
+  } catch (err) {
+    if (err && err.message === 'invalid-utf8') {
+      return invalidResult('invalid-utf8');
+    }
+    if (err && (err.code === 'EACCES' || err.code === 'EPERM')) {
+      return invalidResult('unreadable');
+    }
+    return invalidResult('unreadable');
+  } finally {
+    await handle.close().catch(() => {});
+  }
+}
+
+/**
+ * Strict incremental UTF-8 decoder that rejects overlong, surrogate,
+ * >U+10FFFF and truncated sequences; throws Error('invalid-utf8').
+ */
+function createStrictDecoder() {
+  let needed = 0;
+  let value = 0;
+  let min = 0;
+
+  function push(out, cp, seqMin) {
+    if (cp < seqMin || cp > 0x10ffff || (cp >= 0xd800 && cp <= 0xdfff)) {
+      throw new Error('invalid-utf8');
+    }
+    out.push(cp);
+  }
+
+  return {
+    /** @param {Buffer|Uint8Array} chunk @returns {number[]} */
+    decode(chunk) {
+      const out = [];
+      for (let i = 0; i < chunk.length; i += 1) {
+        const b = chunk[i];
+        if (needed > 0) {
+          if (b < 0x80 || b > 0xbf) throw new Error('invalid-utf8');
+          value = (value << 6) | (b & 0x3f);
+          needed -= 1;
+          if (needed === 0) {
+            push(out, value, min);
+          }
+          continue;
+        }
+        if (b < 0x80) {
+          out.push(b);
+        } else if (b >= 0xc2 && b <= 0xdf) {
+          needed = 1; min = 0x80; value = b & 0x1f;
+        } else if (b >= 0xe0 && b <= 0xef) {
+          needed = 2; min = 0x800; value = b & 0x0f;
+        } else if (b >= 0xf0 && b <= 0xf4) {
+          needed = 3; min = 0x10000; value = b & 0x07;
+        } else {
+          throw new Error('invalid-utf8');
+        }
+      }
+      return out;
+    },
+    flush() {
+      if (needed > 0) throw new Error('invalid-utf8');
+    },
+  };
+}
+
+/**
+ * Deterministic envelope renderer. Warning states render as the frozen
+ * warning literal only; ready/oversized render the full envelope.
+ * Fail-open: any internal render error degrades to the deterministic
+ * `unreadable` warning — no throw escapes this entry point.
+ *
+ * @param {{ state: string, body?: string }} inspection
+ * @returns {string}
+ */
+export function renderProjectImportant(inspection) {
+  try {
+    const { state, body } = inspection || {};
+    if (state !== 'ready' && state !== 'oversized') {
+      return PROJECT_IMPORTANT_WARNINGS[state] || PROJECT_IMPORTANT_WARNINGS.unreadable;
+    }
+    const warning = state === 'oversized'
+      ? PROJECT_IMPORTANT_WARNINGS.oversized + '\n'
+      : '';
+    // Framing newline outside the body: body bytes are preserved verbatim,
+    // the END marker always starts on its own line.
+    const framing = body.endsWith('\n') ? '' : '\n';
+    return (
+      PROJECT_IMPORTANT_ENVELOPE_HEADER
+      + body
+      + framing
+      + END_MARKER
+      + warning
+      + PROJECT_IMPORTANT_ENVELOPE_FOOTER
+    );
+  } catch {
+    return PROJECT_IMPORTANT_WARNINGS.unreadable;
+  }
+}
+
+/**
+ * Convenience: inspect + ensure `rendered` is populated.
+ * Fail-open: an unexpected inspector/render error degrades to the
+ * deterministic `unreadable` result instead of throwing.
+ *
+ * @param {string} projectRoot
+ * @param {{ config?: object }} [options]
+ */
+export async function renderProjectImportantForProject(projectRoot, options = {}) {
+  try {
+    const inspection = await inspectProjectImportant({ projectRoot, ...options });
+    if (inspection.rendered === undefined) {
+      inspection.rendered = renderProjectImportant(inspection);
+    }
+    return inspection;
+  } catch {
+    return invalidResult('unreadable');
+  }
+}
+
+// CLI entry (TASK-041, spec §9): `node project-important.mjs` prints the
+// deterministic rendered envelope — or the frozen invalid-state warning — for
+// the resolved project root. Advisory fail-open: any unexpected error degrades
+// to the deterministic `unreadable` warning and the process still exits 0, so a
+// SessionStart hook can never block the session on a renderer fault.
+if (
+  process.argv[1]
+  && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)
+) {
+  try {
+    const projectRoot = process.env.UKIT_PROJECT_ROOT
+      || process.env.CLAUDE_PROJECT_DIR
+      || process.cwd();
+    const inspection = await renderProjectImportantForProject(projectRoot);
+    process.stdout.write(`${inspection.rendered ?? PROJECT_IMPORTANT_WARNINGS.unreadable}\n`);
+  } catch {
+    process.stdout.write(`${PROJECT_IMPORTANT_WARNINGS.unreadable}\n`);
+  }
+}

package/templates/.claude/ukit/runtime/sensitive-value-scanner.mjs

@@ -0,0 +1,128 @@
+/**
+ * sensitive-value-scanner.mjs (TASK-038)
+ *
+ * Installed-runtime mirror of src/core/sensitiveValueScanner.js — the
+ * high-confidence secret *value* scanner shared with
+ * templates/.claude/hooks/sensitive-data-guard.sh. Deliberate mirror: the
+ * installed runtime cannot import package source, so this file is kept
+ * byte-semantic with the source module and locked by
+ * tests/consistency/projectImportantRuntimeParity.test.js.
+ *
+ * Scope is the value scanner only: vendor/API-key patterns, JWT, private-key
+ * block, SHA-256 exact-value allowlist matching, and the
+ * security.sensitiveDataGate config read. File/path classification and Bash
+ * command-shape logic stay in the hook.
+ *
+ * Leak-safety contract: return values carry labels only — never a secret
+ * value, prefix, suffix, excerpt, or hash of a matched secret.
+ */
+
+import { createHash } from 'node:crypto';
+
+// Hook-context self-deadline (2.4.1 orphan-leak class): a hook wrapper passes
+// UKIT_HOOK_DEADLINE_MS so a wedged scan can never orphan this process past
+// the hook budget. CLI usage never sets it and is never self-killed.
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || '', 10);
+if (Number.isFinite(HOOK_DEADLINE_MS) && HOOK_DEADLINE_MS > 0) {
+  setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
+}
+
+function sha256(value) {
+  return createHash('sha256').update(value).digest('hex');
+}
+
+// --- high-confidence secret value patterns ---
+// Semantically identical to TOKEN_PATTERNS in sensitive-data-guard.sh.
+// AKIA/ASIA/AIza prefixes are pure base64-compatible text, so an encoded blob
+// can contain a coincidental key-shaped substring — those rules must stand
+// alone with no base64/base64url character on either side.
+const TOKEN_PATTERNS = [
+  { label: 'OpenAI/Anthropic-style API key', re: /\bsk-(?:proj-|ant-|svc-|acct-|admin-)?[A-Za-z0-9_-]{20,}/g },
+  { label: 'AWS access key id', re: /(?<![A-Za-z0-9+/_-])(?:AKIA|ASIA)[0-9A-Z]{16}(?![A-Za-z0-9+/_-])/g },
+  { label: 'GitHub token', re: /\bgh[pousr]_[A-Za-z0-9]{30,}\b/g },
+  { label: 'GitHub fine-grained token', re: /\bgithub_pat_[A-Za-z0-9_]{20,}/g },
+  { label: 'GitLab token', re: /\bglpat-[A-Za-z0-9_-]{20,}/g },
+  { label: 'Slack token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/g },
+  { label: 'Google API key', re: /(?<![A-Za-z0-9+/_-])AIza[0-9A-Za-z_-]{20,}(?![A-Za-z0-9+/_-])/g },
+  { label: 'Stripe live key', re: /\b[srp]k_live_[A-Za-z0-9]{20,}/g },
+  { label: 'JWT', re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+  { label: 'private key block', re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----/g },
+];
+
+const SHA256_HEX_RE = /^[0-9a-f]{64}$/i;
+
+/**
+ * Scan text for high-confidence secret values.
+ *
+ * @param {string} text
+ * @param {{ allowlistHashes?: string[], gateEnabled?: boolean }} [options]
+ *   allowlistHashes: SHA-256 hex digests of explicitly approved exact values.
+ *   gateEnabled: pass isSensitiveDataGateEnabled(config); when false the scan
+ *   reports the gate's exit-0 semantics (no detection) like today's hook.
+ * @returns {{ hasSecret: boolean, allowed: boolean, labels: string[] }}
+ *   labels only — never values, excerpts, or hashes.
+ */
+export function scanText(text, options = {}) {
+  const { allowlistHashes = [], gateEnabled = true } = options || {};
+  const clean = { hasSecret: false, allowed: false, labels: [] };
+  if (gateEnabled === false) return clean;
+  if (typeof text !== 'string' || text.length === 0) return clean;
+
+  const allowed = new Set(
+    Array.isArray(allowlistHashes) ? allowlistHashes.filter((h) => typeof h === 'string') : [],
+  );
+
+  const labels = new Set();
+  let sawAllowlisted = false;
+  for (const { label, re } of TOKEN_PATTERNS) {
+    re.lastIndex = 0;
+    let match;
+    while ((match = re.exec(text)) !== null) {
+      if (allowed.has(sha256(match[0]))) {
+        sawAllowlisted = true;
+        continue;
+      }
+      labels.add(label);
+    }
+  }
+
+  if (labels.size === 0) {
+    return { hasSecret: false, allowed: sawAllowlisted, labels: [] };
+  }
+  return { hasSecret: true, allowed: false, labels: [...labels] };
+}
+
+/**
+ * Gate toggle: enabled unless security.sensitiveDataGate === false
+ * (mirrors the hook's explicit-false check on .ukit/storage/config.json).
+ *
+ * @param {object|null|undefined} config injected config object
+ * @returns {boolean}
+ */
+export function isSensitiveDataGateEnabled(config) {
+  if (config && config.security && config.security.sensitiveDataGate === false) {
+    return false;
+  }
+  return true;
+}
+
+/**
+ * Load the SHA-256 exact-value allowlist from an injected config object.
+ * Accepts security.allowlist.values (mirror of allowlist.json) or
+ * security.sensitiveDataAllowlist; keeps only well-formed 64-hex digests.
+ *
+ * @param {object|null|undefined} config
+ * @returns {string[]} SHA-256 hex digests
+ */
+export function loadSensitiveAllowlist(config) {
+  if (!config || typeof config !== 'object') return [];
+  const security = config.security && typeof config.security === 'object' ? config.security : {};
+  const candidates = [];
+  if (security.allowlist && Array.isArray(security.allowlist.values)) {
+    candidates.push(...security.allowlist.values);
+  }
+  if (Array.isArray(security.sensitiveDataAllowlist)) {
+    candidates.push(...security.sensitiveDataAllowlist);
+  }
+  return candidates.filter((v) => typeof v === 'string' && SHA256_HEX_RE.test(v));
+}

package/templates/.omp/hooks/pre/ukit-bridge.js

@@ -56,7 +56,7 @@ export const HOOK_EVENT_MAP = {
   },
   before_agent_start: ['sensitive-data-guard.sh', 'skill-router.sh', 'vision-router.sh', 'context-window-guard.sh'],
   'session.compacting': ['reinject-context.sh'],
-  session_start: ['auto-prune-bash.sh', 'reset-compact-pressure.sh', 'handoff-resume.sh'],
+  session_start: ['project-important.sh', 'auto-prune-bash.sh', 'reset-compact-pressure.sh', 'handoff-resume.sh'],
 };
 
 const TOOL_NAME_MAP = {
@@ -111,6 +111,7 @@ export const ADVISORY_SCRIPTS = new Set([
   'task-watchdog.sh',
   'compress-output.sh',
   'reinject-context.sh',
+  'project-important.sh',
   'auto-prune-bash.sh',
   'reset-compact-pressure.sh',
   'handoff-resume.sh',
@@ -703,10 +704,12 @@ export async function runSessionCompact(pi, event, { projectRoot, context: exten
   // session_compact fires only after agent.replaceMessages()/rebaseAfterCompaction() already
   // ran (session-maintenance.ts), i.e. the session is idle here, and agent-session.ts's
   // sendCustomMessage() non-streaming branch appends the message to the live context
-  // regardless of deliverAs — so 'steer' is accepted right after a compaction. Not a live
-  // repro, so the 'nextTurn' copy below stays as defense in depth.
+  // regardless of deliverAs — so 'steer' is accepted right after a compaction.
+  // TASK-042: delivery is exact-once. The former defense-in-depth 'nextTurn' copy produced
+  // a second model-visible duplicate of the same context; per spec §10/§17 Phase 5 keep
+  // 'steer' only (switch to 'nextTurn' ONLY if a live omp smoke proves 'steer' is not
+  // retained after compact — never both).
   sendContext(pi, result.context, 'steer');
-  sendContext(pi, result.context, 'nextTurn');
   return undefined;
 }
 

package/templates/AGENTS.md

@@ -238,6 +238,14 @@ At the start of every OpenCode session, before working on the first task:
 4. If the route result points to a skill, read that SKILL.md before acting — do not skip this step.
 5. If `.ukit/storage/config.json` has `router.enabled: true`, prefer the router output over ad-hoc guessing.
 
+## Project Owner Instructions — Codex and OpenCode
+
+When running in Codex or OpenCode, read and follow the root
+`PROJECT_IMPORTANT.md` before doing project work. It is the canonical
+project-owner instruction source. Do not copy its contents into this file.
+If it is missing or unreadable, state that limitation and continue with the
+remaining project instructions.
+
 ## Skills
 
 - Canonical skills live in `.claude/skills/`.

package/templates/PROJECT_IMPORTANT.md

@@ -0,0 +1,9 @@
+# Project Important Instructions
+
+<!--
+Add project-specific, non-negotiable AI instructions here.
+
+UKit creates this file only when it is missing. After creation, UKit never rewrites,
+merges, formats, chmods, or deletes it. Keep it at or below 6,000 Unicode code
+points for complete runtime injection. Do not put credentials or secrets here.
+-->