claude-code-superkit 0.0.0-stage → 1.5.3

package/packages/codex/rules/default.rules

@@ -0,0 +1,565 @@
+# default.rules — Codex CLI approval policy for claude-code-superkit
+#
+# DSL format (adapted from VKirill/codex-starter-kit, MIT):
+#   prefix_rule(pattern=[...], decision="allow|forbidden|prompt", justification="...", match=[...])
+#
+# Decisions:
+#   allow      — permits at the execution-rule layer
+#   prompt     — requires approval, subject to the active approval policy
+#   forbidden  — forbids the matching command
+# Rules apply outside the sandbox; they do not grant task authority.
+#
+# Pattern matching is a prefix tuple match against the command argv.
+# Most restrictive matching decision wins: forbidden > prompt > allow.
+#
+# Philosophy: maximize developer flow for safe commands; require approval
+# for state-changing operations; forbid destructive system calls.
+
+# =============================================================================
+# DESTRUCTIVE — never allowed
+# =============================================================================
+
+prefix_rule(
+    pattern = ["rm", "-rf", "/"],
+    decision = "forbidden",
+    justification = "Recursive deletion of root filesystem is irrecoverable.",
+)
+
+prefix_rule(
+    pattern = ["rm", "-rf", "/*"],
+    decision = "forbidden",
+    justification = "Recursive deletion of root filesystem is irrecoverable.",
+)
+
+prefix_rule(
+    pattern = ["sudo"],
+    decision = "forbidden",
+    justification = "Privilege escalation is blocked. Ask the user for an explicit one-off elevated command if needed.",
+)
+
+prefix_rule(
+    pattern = ["dd"],
+    decision = "forbidden",
+    justification = "Raw disk writes can destroy data. Use a safer file-level tool.",
+    match = ["dd if=/dev/zero of=/dev/sda", "dd if=image.iso of=/dev/disk2"],
+)
+
+prefix_rule(
+    pattern = ["mkfs"],
+    decision = "forbidden",
+    justification = "Formatting filesystems must be performed manually by the user.",
+)
+
+prefix_rule(
+    pattern = ["wipefs"],
+    decision = "forbidden",
+    justification = "Filesystem signature wiping must be performed manually by the user.",
+)
+
+prefix_rule(
+    pattern = ["shutdown"],
+    decision = "forbidden",
+    justification = "System shutdown must be performed manually by the user.",
+)
+
+prefix_rule(
+    pattern = ["reboot"],
+    decision = "forbidden",
+    justification = "System reboot must be performed manually by the user.",
+)
+
+prefix_rule(
+    pattern = ["halt"],
+    decision = "forbidden",
+    justification = "System halt must be performed manually by the user.",
+)
+
+prefix_rule(
+    pattern = ["shred"],
+    decision = "forbidden",
+    justification = "Secure deletion is irreversible. Use trash or ask for explicit approval.",
+)
+
+# =============================================================================
+# PERMISSION / OWNERSHIP — always ask
+# =============================================================================
+
+prefix_rule(
+    pattern = ["chmod"],
+    decision = "prompt",
+    justification = "Permission changes can expose secrets or break apps. Ask for exact target + mode.",
+    match = ["chmod -R 777 .", "chmod 600 .env"],
+)
+
+prefix_rule(
+    pattern = ["chown"],
+    decision = "prompt",
+    justification = "Ownership changes can break workspace permissions.",
+)
+
+# =============================================================================
+# RM — case-by-case (root forbidden above, named paths require prompt)
+# =============================================================================
+
+prefix_rule(
+    pattern = ["rm"],
+    decision = "prompt",
+    justification = "Confirm exact target before deletion. Prefer trash where available.",
+    match = ["rm node_modules", "rm -rf .next/cache"],
+)
+
+# =============================================================================
+# GIT — most allowed; force-push and reset --hard require approval upstream
+# =============================================================================
+
+prefix_rule(pattern=["git", "status"], decision="allow")
+prefix_rule(pattern=["git", "log"], decision="allow")
+prefix_rule(pattern=["git", "diff"], decision="allow")
+prefix_rule(pattern=["git", "show"], decision="allow")
+prefix_rule(pattern=["git", "blame"], decision="allow")
+prefix_rule(pattern=["git", "branch"], decision="allow")
+prefix_rule(pattern=["git", "switch"], decision="allow")
+prefix_rule(pattern=["git", "checkout"], decision="allow")
+prefix_rule(pattern=["git", "add"], decision="allow")
+prefix_rule(pattern=["git", "commit"], decision="allow")
+prefix_rule(pattern=["git", "fetch"], decision="allow")
+prefix_rule(pattern=["git", "pull"], decision="allow")
+prefix_rule(pattern=["git", "merge"], decision="allow")
+prefix_rule(pattern=["git", "rebase"], decision="allow")
+prefix_rule(pattern=["git", "stash"], decision="allow")
+prefix_rule(pattern=["git", "tag"], decision="allow")
+prefix_rule(pattern=["git", "rev-parse"], decision="allow")
+prefix_rule(pattern=["git", "config"], decision="allow")
+prefix_rule(pattern=["git", "remote"], decision="allow")
+
+# NOTE on git push --force coverage:
+# prefix_rule matches as an argv prefix tuple. `git push --force origin main`
+# matches ["git", "push", "--force"], but `git push origin main --force`
+# does NOT — the flag lands on position 4, not 2. Codex CLI's rule engine
+# does not support substring/regex on argv tails. So `git push` is left
+# as decision="prompt" rather than "allow" so the user is asked for every
+# push (one extra confirmation is the price of not getting silently
+# force-pushed by argv-position trickery). Real protection of main branch
+# happens at the host (GitHub branch protection rules), not here.
+prefix_rule(
+    pattern = ["git", "push", "--force"],
+    decision = "prompt",
+    justification = "Force-push rewrites remote history. Confirm branch and target.",
+)
+prefix_rule(
+    pattern = ["git", "push", "-f"],
+    decision = "prompt",
+    justification = "Force-push rewrites remote history. Confirm branch and target.",
+)
+prefix_rule(
+    pattern = ["git", "push", "--force-with-lease"],
+    decision = "prompt",
+    justification = "Force-push (safer variant) still rewrites remote history.",
+)
+prefix_rule(
+    pattern = ["git", "push"],
+    decision = "prompt",
+    justification = "Push touches remote state and may carry a --force flag after the ref. Confirm.",
+)
+
+# Same argv-position caveat for reset --hard. We keep `git reset` at prompt
+# rather than allow so `git reset HEAD --hard` (--hard at position 3) still
+# triggers a confirmation.
+prefix_rule(
+    pattern = ["git", "reset", "--hard"],
+    decision = "prompt",
+    justification = "Hard reset discards uncommitted work. Confirm target ref.",
+)
+prefix_rule(
+    pattern = ["git", "reset"],
+    decision = "prompt",
+    justification = "Reset may include --hard after the ref. Confirm.",
+)
+
+prefix_rule(
+    pattern = ["git", "clean", "-fdx"],
+    decision = "prompt",
+    justification = "git clean -fdx removes untracked files and ignored dirs (incl. node_modules). Confirm.",
+)
+
+# History-rewriting tools — irreversible without an external backup. Always prompt.
+prefix_rule(
+    pattern = ["git", "filter-repo"],
+    decision = "prompt",
+    justification = "filter-repo rewrites entire repo history. Confirm refs and replacements.",
+)
+prefix_rule(
+    pattern = ["git", "filter-branch"],
+    decision = "prompt",
+    justification = "filter-branch rewrites history (slower / less safe than filter-repo). Confirm.",
+)
+prefix_rule(
+    pattern = ["git", "rebase", "-i"],
+    decision = "prompt",
+    justification = "Interactive rebase rewrites local history. Confirm target ref.",
+)
+prefix_rule(
+    pattern = ["git", "rebase", "--root"],
+    decision = "prompt",
+    justification = "Rebasing from root rewrites all history. Confirm.",
+)
+prefix_rule(
+    pattern = ["git", "update-ref", "-d"],
+    decision = "prompt",
+    justification = "Deletes a ref directly. Confirm.",
+)
+prefix_rule(
+    pattern = ["git", "reflog", "expire"],
+    decision = "prompt",
+    justification = "Expiring reflog removes the safety net for recently-rewritten history.",
+)
+prefix_rule(
+    pattern = ["git", "clean", "-fd"],
+    decision = "prompt",
+    justification = "git clean -fd removes untracked files. Confirm.",
+)
+
+# =============================================================================
+# GH CLI — most allowed
+# =============================================================================
+
+prefix_rule(pattern=["gh", "pr"], decision="allow")
+prefix_rule(pattern=["gh", "issue"], decision="allow")
+prefix_rule(pattern=["gh", "repo", "view"], decision="allow")
+prefix_rule(pattern=["gh", "repo", "list"], decision="allow")
+prefix_rule(pattern=["gh", "release"], decision="allow")
+prefix_rule(pattern=["gh", "workflow"], decision="allow")
+prefix_rule(pattern=["gh", "run"], decision="allow")
+prefix_rule(pattern=["gh", "api"], decision="allow")
+prefix_rule(pattern=["gh", "auth", "status"], decision="allow")
+
+prefix_rule(
+    pattern = ["gh", "repo", "delete"],
+    decision = "forbidden",
+    justification = "Repository deletion is permanent. Must be done by the user manually.",
+)
+
+# =============================================================================
+# NPM / PNPM / YARN — installs and reads allowed, publish/unpublish prompt
+# =============================================================================
+
+prefix_rule(pattern=["npm", "view"], decision="allow")
+prefix_rule(pattern=["npm", "info"], decision="allow")
+prefix_rule(pattern=["npm", "search"], decision="allow")
+prefix_rule(pattern=["npm", "ping"], decision="allow")
+prefix_rule(pattern=["npm", "config", "get"], decision="allow")
+prefix_rule(pattern=["npm", "list"], decision="allow")
+prefix_rule(pattern=["npm", "ls"], decision="allow")
+prefix_rule(pattern=["npm", "install"], decision="allow")
+prefix_rule(pattern=["npm", "ci"], decision="allow")
+prefix_rule(pattern=["npm", "run"], decision="allow")
+prefix_rule(pattern=["npm", "test"], decision="allow")
+prefix_rule(pattern=["npm", "audit"], decision="allow")
+prefix_rule(pattern=["npm", "outdated"], decision="allow")
+
+prefix_rule(
+    pattern = ["npm", "publish"],
+    decision = "prompt",
+    justification = "Publishing pushes a package to the registry. Confirm version, scope, and tag.",
+)
+prefix_rule(
+    pattern = ["npm", "unpublish"],
+    decision = "prompt",
+    justification = "Unpublishing is mostly irreversible and breaks dependents.",
+)
+
+prefix_rule(pattern=["pnpm"], decision="allow")
+prefix_rule(pattern=["yarn"], decision="allow")
+prefix_rule(pattern=["bun"], decision="allow")
+prefix_rule(pattern=["npx"], decision="allow")
+
+# =============================================================================
+# PYTHON / PIP / UV
+# =============================================================================
+
+prefix_rule(pattern=["python"], decision="allow")
+prefix_rule(pattern=["python3"], decision="allow")
+prefix_rule(pattern=["pip"], decision="allow")
+prefix_rule(pattern=["pip3"], decision="allow")
+prefix_rule(pattern=["uv"], decision="allow")
+prefix_rule(pattern=["poetry"], decision="allow")
+prefix_rule(pattern=["pipx"], decision="allow")
+
+# =============================================================================
+# GO / RUST / OTHER COMPILERS
+# =============================================================================
+
+prefix_rule(pattern=["go"], decision="allow")
+prefix_rule(pattern=["cargo"], decision="allow")
+prefix_rule(pattern=["rustc"], decision="allow")
+prefix_rule(pattern=["javac"], decision="allow")
+prefix_rule(pattern=["mvn"], decision="allow")
+prefix_rule(pattern=["gradle"], decision="allow")
+prefix_rule(pattern=["./gradlew"], decision="allow")
+
+# =============================================================================
+# DOCKER / KUBERNETES — read allowed, destructive prompt
+# =============================================================================
+
+prefix_rule(pattern=["docker", "ps"], decision="allow")
+prefix_rule(pattern=["docker", "logs"], decision="allow")
+prefix_rule(pattern=["docker", "inspect"], decision="allow")
+prefix_rule(pattern=["docker", "images"], decision="allow")
+prefix_rule(pattern=["docker", "build"], decision="allow")
+prefix_rule(pattern=["docker", "run"], decision="allow")
+prefix_rule(pattern=["docker", "compose"], decision="allow")
+prefix_rule(pattern=["docker-compose"], decision="allow")
+
+prefix_rule(
+    pattern = ["docker", "system", "prune"],
+    decision = "prompt",
+    justification = "Prune deletes containers, images, networks, and build cache. Confirm scope.",
+)
+prefix_rule(
+    pattern = ["docker", "volume", "prune"],
+    decision = "prompt",
+    justification = "Volume prune deletes anonymous volumes — possibly with data.",
+)
+
+prefix_rule(pattern=["kubectl", "get"], decision="allow")
+prefix_rule(pattern=["kubectl", "describe"], decision="allow")
+prefix_rule(pattern=["kubectl", "logs"], decision="allow")
+prefix_rule(pattern=["kubectl", "exec"], decision="allow")
+prefix_rule(pattern=["kubectl", "apply"], decision="allow")
+prefix_rule(pattern=["kubectl", "rollout"], decision="allow")
+
+prefix_rule(
+    pattern = ["kubectl", "delete"],
+    decision = "prompt",
+    justification = "kubectl delete removes cluster resources. Confirm namespace + resource.",
+)
+
+# =============================================================================
+# SYSTEMD / SERVICE MANAGERS — restart allowed, enable/disable prompt
+# =============================================================================
+
+prefix_rule(pattern=["systemctl", "status"], decision="allow")
+prefix_rule(pattern=["systemctl", "start"], decision="allow")
+prefix_rule(pattern=["systemctl", "stop"], decision="allow")
+prefix_rule(pattern=["systemctl", "restart"], decision="allow")
+prefix_rule(pattern=["systemctl", "reload"], decision="allow")
+
+prefix_rule(
+    pattern = ["systemctl", "enable"],
+    decision = "prompt",
+    justification = "Changing boot-time service state affects the host.",
+)
+prefix_rule(
+    pattern = ["systemctl", "disable"],
+    decision = "prompt",
+    justification = "Changing boot-time service state affects the host.",
+)
+prefix_rule(
+    pattern = ["systemctl", "mask"],
+    decision = "prompt",
+    justification = "Masking services can break host behavior.",
+)
+
+prefix_rule(pattern=["pm2", "list"], decision="allow")
+prefix_rule(pattern=["pm2", "logs"], decision="allow")
+prefix_rule(pattern=["pm2", "describe"], decision="allow")
+prefix_rule(pattern=["pm2", "start"], decision="allow")
+prefix_rule(pattern=["pm2", "restart"], decision="allow")
+prefix_rule(pattern=["pm2", "reload"], decision="allow")
+prefix_rule(pattern=["pm2", "stop"], decision="allow")
+prefix_rule(
+    pattern = ["pm2", "delete"],
+    decision = "prompt",
+    justification = "pm2 delete removes a process from the manager — confirm name.",
+)
+
+prefix_rule(pattern=["supervisorctl", "status"], decision="allow")
+prefix_rule(pattern=["supervisorctl", "restart"], decision="allow")
+prefix_rule(pattern=["supervisorctl", "start"], decision="allow")
+prefix_rule(pattern=["supervisorctl", "stop"], decision="allow")
+
+# =============================================================================
+# WEB SERVERS — config check + reload allowed; full restart prompt
+# =============================================================================
+
+prefix_rule(pattern=["nginx", "-t"], decision="allow")
+prefix_rule(pattern=["nginx", "-s", "reload"], decision="allow")
+prefix_rule(pattern=["caddy", "validate"], decision="allow")
+prefix_rule(pattern=["caddy", "reload"], decision="allow")
+prefix_rule(pattern=["apachectl", "configtest"], decision="allow")
+prefix_rule(pattern=["apachectl", "graceful"], decision="allow")
+
+# =============================================================================
+# OBSERVABILITY / SHELL UTILS — universally safe reads
+# =============================================================================
+
+prefix_rule(pattern=["ls"], decision="allow")
+prefix_rule(pattern=["pwd"], decision="allow")
+prefix_rule(pattern=["cat"], decision="allow")
+prefix_rule(pattern=["head"], decision="allow")
+prefix_rule(pattern=["tail"], decision="allow")
+prefix_rule(pattern=["less"], decision="allow")
+prefix_rule(pattern=["wc"], decision="allow")
+prefix_rule(pattern=["grep"], decision="allow")
+prefix_rule(pattern=["rg"], decision="allow")
+prefix_rule(pattern=["find"], decision="allow")
+prefix_rule(pattern=["fd"], decision="allow")
+prefix_rule(pattern=["which"], decision="allow")
+prefix_rule(pattern=["whoami"], decision="allow")
+prefix_rule(pattern=["hostname"], decision="allow")
+prefix_rule(pattern=["env"], decision="allow")
+prefix_rule(pattern=["date"], decision="allow")
+prefix_rule(pattern=["uname"], decision="allow")
+prefix_rule(pattern=["ps"], decision="allow")
+prefix_rule(pattern=["top"], decision="allow")
+prefix_rule(pattern=["htop"], decision="allow")
+prefix_rule(pattern=["df"], decision="allow")
+prefix_rule(pattern=["du"], decision="allow")
+prefix_rule(pattern=["free"], decision="allow")
+prefix_rule(pattern=["jq"], decision="allow")
+prefix_rule(pattern=["yq"], decision="allow")
+prefix_rule(pattern=["sed"], decision="allow")
+prefix_rule(pattern=["awk"], decision="allow")
+prefix_rule(pattern=["echo"], decision="allow")
+prefix_rule(pattern=["printf"], decision="allow")
+prefix_rule(pattern=["http"], decision="allow")
+
+# NOTE on curl | bash:
+# Simple compound shell commands may be split into individual commands for
+# checking; complex shell syntax may be checked as the whole invocation.
+# These prefix rules request approval for curl/wget and inline bash/sh. They
+# do not provide a blanket prohibition of download-and-execute pipelines.
+prefix_rule(
+    pattern = ["curl"],
+    decision = "prompt",
+    justification = "Curl may be piped into a shell. Confirm URL and target.",
+)
+prefix_rule(
+    pattern = ["wget"],
+    decision = "prompt",
+    justification = "Wget may be piped into a shell. Confirm URL and target.",
+)
+prefix_rule(
+    pattern = ["bash", "-c"],
+    decision = "prompt",
+    justification = "Arbitrary inline shell. Inspect the command before running.",
+)
+prefix_rule(
+    pattern = ["sh", "-c"],
+    decision = "prompt",
+    justification = "Arbitrary inline shell. Inspect the command before running.",
+)
+
+# =============================================================================
+# DATABASE CLIENTS — read allowed, destructive prompt
+# =============================================================================
+
+prefix_rule(pattern=["psql"], decision="allow")
+# mysql -e and sqlite3 inline statements share the psql -c caveat —
+# the SQL ends up as a single argv token that prefix_rule cannot inspect.
+prefix_rule(
+    pattern = ["mysql", "-e"],
+    decision = "prompt",
+    justification = "Inline SQL via mysql -e — text is in a single argv token, cannot be inspected by prefix matching.",
+)
+prefix_rule(
+    pattern = ["mysql", "--execute"],
+    decision = "prompt",
+    justification = "Inline SQL via mysql --execute — same caveat as -e.",
+)
+prefix_rule(pattern=["mysql"], decision="allow")
+prefix_rule(pattern=["redis-cli"], decision="allow")
+prefix_rule(pattern=["sqlite3"], decision="allow")
+prefix_rule(pattern=["mongosh"], decision="allow")
+
+prefix_rule(
+    pattern = ["pg_dump"],
+    decision = "allow",
+    justification = "Read-only backup operation.",
+)
+prefix_rule(
+    pattern = ["dropdb"],
+    decision = "prompt",
+    justification = "dropdb removes a database. Confirm name.",
+)
+
+# NOTE on psql -c:
+# When user runs `psql -c "DROP TABLE x"`, argv[2] is the full string
+# "DROP TABLE x", not the token "DROP". A prefix_rule pattern
+# ["psql", "-c", "DROP"] only matches when argv[2] == "DROP" exactly,
+# which never happens — the SQL statement is always at least 2 words.
+# Codex's rule engine does not support substring/regex on argv tails.
+#
+# Therefore: any psql -c (inline SQL) lands at "prompt", since we cannot
+# selectively match destructive SQL within argv[2]. The user sees the
+# full SQL string before execution. Read-only interactive psql sessions
+# (without -c) remain at the broader "psql" allow rule.
+prefix_rule(
+    pattern = ["psql", "-c"],
+    decision = "prompt",
+    justification = "Inline SQL via psql -c — text is in a single argv token, cannot be inspected by prefix matching. Confirm the SQL.",
+)
+prefix_rule(
+    pattern = ["psql", "--command"],
+    decision = "prompt",
+    justification = "Inline SQL via psql --command — same caveat as -c.",
+)
+prefix_rule(
+    pattern = ["psql", "-f"],
+    decision = "prompt",
+    justification = "psql -f runs a SQL file. Confirm path before execution.",
+)
+prefix_rule(
+    pattern = ["psql", "--file"],
+    decision = "prompt",
+    justification = "psql --file runs a SQL file. Confirm path before execution.",
+)
+prefix_rule(
+    pattern = ["kubectl", "drain"],
+    decision = "prompt",
+    justification = "kubectl drain evicts pods from a node. Confirm.",
+)
+prefix_rule(
+    pattern = ["terraform", "destroy"],
+    decision = "prompt",
+    justification = "terraform destroy tears down infrastructure. Confirm targets.",
+)
+prefix_rule(
+    pattern = ["terraform", "apply"],
+    decision = "prompt",
+    justification = "terraform apply mutates infrastructure. Confirm plan.",
+)
+prefix_rule(
+    pattern = ["redis-cli", "FLUSHDB"],
+    decision = "prompt",
+    justification = "FLUSHDB wipes the current Redis DB.",
+)
+prefix_rule(
+    pattern = ["redis-cli", "FLUSHALL"],
+    decision = "prompt",
+    justification = "FLUSHALL wipes ALL Redis DBs.",
+)
+
+# =============================================================================
+# TEST RUNNERS / LINTERS — all allowed
+# =============================================================================
+
+prefix_rule(pattern=["pytest"], decision="allow")
+prefix_rule(pattern=["jest"], decision="allow")
+prefix_rule(pattern=["vitest"], decision="allow")
+prefix_rule(pattern=["mocha"], decision="allow")
+prefix_rule(pattern=["eslint"], decision="allow")
+prefix_rule(pattern=["prettier"], decision="allow")
+prefix_rule(pattern=["ruff"], decision="allow")
+prefix_rule(pattern=["black"], decision="allow")
+prefix_rule(pattern=["mypy"], decision="allow")
+prefix_rule(pattern=["tsc"], decision="allow")
+prefix_rule(pattern=["golangci-lint"], decision="allow")
+prefix_rule(pattern=["gofmt"], decision="allow")
+prefix_rule(pattern=["clippy"], decision="allow")
+prefix_rule(pattern=["rustfmt"], decision="allow")
+
+# =============================================================================
+# FALLBACK
+# =============================================================================
+# Anything not matched above falls through to Codex CLI's own approval policy.

package/packages/codex/skills/ai-slop-cleaner/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: ai-slop-cleaner
+description: Review or remove evidence-backed redundant code and commentary within an authorized scope while preserving behavior. Use for a focused cleanup after implementation or before review, not feature work or logic fixes.
+user-invocable: false
+tokens: 1221
+---
+
+# AI Slop Cleaner
+
+Improve readability by removing demonstrated redundancy without changing behavior. “AI-generated” appearance is a search hint, not evidence that code is wrong or disposable. A clean result with no changes is valid. Use after implementation or before review; in `dev-orchestrator`, these are Phase 7 — Implement and Phase 12 — Review, not a substitute for its intervening acceptance gates.
+
+## Scope and authority
+
+Start with the request, target diff/paths, applicable project instructions, relevant style/lint configuration, and tests/contracts. Review requests are read-only; cleanup requests permit only authorized behavior-preserving edits. Inspect relevant callers, exports, generated-code markers, and framework use before deciding something is redundant. Preserve dirty work owned by others.
+
+If the scope or evidence is ambiguous, ask the question that resolves it and leave the uncertain code unchanged. Do not sweep the repository, reformat unrelated code, rename public APIs, add features, change configuration, or make external writes because of this role. Report logic/security defects separately for bounded authorized follow-up.
+
+## Assess candidates, not quotas
+
+- **Comments:** remove prose that adds no information beyond nearby code when project conventions allow. Preserve rationale, warnings, meaningful TODOs, API documentation, licenses, directives, generated markers, compiler/linter controls, and tooling annotations. A comment describing “what” can still document a public contract.
+- **Helpers and abstractions:** consider simplifying wrappers, factories, strategies, generic types, interfaces, or speculative flags only when their purpose and consumers are understood. One-use helpers may express a domain, testing, transaction, resource-lifetime, or side-effect boundary; one implementation can still justify an interface. Neither count is a deletion rule.
+- **Compatibility and apparent dead code:** inspect public exports, indirect/reflection-based consumers, serialization, framework callbacks, and generated uses. Preserve required parameter positions, `_` placeholders, default arms, and re-exports unless evidence establishes removal is safe within scope. Type exhaustiveness does not prove external/runtime inputs cannot reach a branch.
+- **Template residue:** identify unnecessary assertions, unreachable scaffolding, empty handlers, and incomplete TODOs, but distinguish redundancy from missing behavior. Changing a swallowed error into logging, propagation, retry, or failure handling changes behavior and is not cleanup; report it separately.
+- **Style:** simplify needless locals, prefixes, boolean wrappers, or verbose names only when supported by local idiom and language semantics. Preserve return types, truthiness/coercion, evaluation order, side effects, resource cleanup, public signatures, and observable behavior. A shorter expression is not automatically equivalent.
+
+For each candidate, explain what makes it redundant and what evidence supports equivalence. Keep uncertain candidates as observations rather than labeling them safe to delete. In edit mode, apply a coherent bounded set of justified changes; no category, finding, line-reduction, or renaming quotas.
+
+## Verification and stopping
+
+Inspect the final diff and use focused regression evidence for affected behavior plus applicable compiler/linter checks and mandatory project gates. Compilation/lint success alone does not prove semantic equivalence. Where equivalence is uncertain and no adequate check exists, retain the original code and state the gap.
+
+Reuse checks only when their command, result, relevant code, inputs, and environment are recorded and unchanged. Rerun for relevant changes or concrete uncertainty, not after every cleanup category by ritual. Stop once the authorized scope is assessed and supported edits are verified, or report the specific blocker without broadening the task.
+
+## Output
+
+Return a compact cleanup report:
+
+- Mode and examined scope; changed paths or “no justified cleanup.”
+- Applied/proposed changes with locations, rationale, and equivalence evidence.
+- Uncertain candidates left unchanged, reasons they may be intentional, and separate behavior-changing findings with impact/confidence.
+- Check commands/results or applicable prior evidence; not-run checks, coverage gaps, and exact remaining action.
+- Execution as independent worker or inline/self-review. Follow explicit model/effort routing; report requested or labeled configured model/effort separately from observed runtime model/effort with evidence. Use UNSPECIFIED for an absent request/default and UNVERIFIED for unavailable runtime evidence. The latter is a reporting limitation, not a new acceptance gate.
+
+Do not claim behavior preservation beyond the inspected scope and supporting evidence, or present a proposed edit as already applied.