riskrails 3.0.0 → 3.0.1

package/skills/ai-task/weight.py

@@ -294,7 +294,7 @@ def mirror(path):
                                       (policy.get("rules") or {}).get("hint_raises_by", 1), h.get("note", ""))
             for h in policy.get("hints") or []]
     out += ["", "Rules: " + json.dumps(policy.get("rules") or {}, ensure_ascii=False), "",
-            "Budgets: review_rounds_max %s · remediation_rounds %s · tests %s" % (
-                policy.get("review_rounds_max"), policy.get("remediation_rounds"),
-                json.dumps(policy.get("tests") or {}))]
+            "Budgets: review_rounds_max %s · remediation_rounds %s · tests %s%s" % (
+                policy.get("review_rounds_max"), policy.get("remediation_rounds"), json.dumps(policy.get("tests") or {}),
+                " · batch %s" % json.dumps(policy["batch"]) if isinstance(policy.get("batch"), dict) else "")]
     return "\n".join(out) + "\n"

package/skills/project-init/templates/constitution.md

@@ -7,7 +7,7 @@ C1. Production behaviour is the source of truth; what looks wrong may be load-be
 C2. A bugfix starts with the failing test; legacy behaviour gets a characterization test before it changes.
 C3. A refactoring changes no behaviour and is never mixed with a feature.
 C4. Every step names its files; scope grows only by amending the plan.
-C5. No agent commits, merges or deploys; a human approves outside the agent.
+C5. No agent merges or deploys; an agent commits, pushes or approves only by running, verbatim and once, a command a human picked in the dialog; otherwise a human runs it outside the agent.
 C6. <!-- project principle — filled by /ai-init from the survey, confirmed by you -->
 C7. <!-- project principle -->
 C8. <!-- project principle -->

package/skills/project-update/history/blobs/164cd34c182de88c33de7df35beb29200d792419e1c13a5f0b2104f944e57be7

@@ -0,0 +1 @@
+{ "version": 1, "enabled": true, "window_seconds": 120, "stop_blocks_max": 2 }

package/skills/project-update/history/blobs/1d1d907449ec74594d0ee923ac142ae746b9aedf0a1eda9469f075a44d23e3d7

@@ -0,0 +1,13 @@
+<!-- riskrails:start -->
+## AI agent workflow
+
+This repository runs an agentic pipeline under `.ai/`. Read `.ai/AGENTS.md` first: it routes to the policies, workflows and rules, which load on demand; `.ai/policies/` is binding.
+
+- Production behaviour is the source of truth: document problems outside the task, do not fix them.
+
+- A change runs through `/rr-build <request>`; `/rr-status` shows where it stands. Each step names the files it may touch — an edit outside them is refused: answer `SCOPE_CHANGE_REQUIRED`.
+
+- Verify before reporting done: `verify_command` from `.ai/policies/testing.md` once, to the end, then `e2e_command` once; every failure fixed as one batch; show the output.
+- No agent merges or deploys; commit, push, approval only as the dialog picks, else a human outside. When a review flags the same mistake twice, the correction goes into this file.
+- Files, not chat, carry decisions: `.ai/reports/<task-id>/task.md` (answer by filling `[Answer]:`), `.ai/state/handoff.md` (read first when resuming), `docs/sdlc/constitution.md` (this project's principles).
+<!-- riskrails:end -->

package/skills/project-update/history/blobs/23a42febbacaa7b52a802d428033a99c0694391c81d51fe3b6e1dff608a641d5

@@ -0,0 +1,67 @@
+# Task state
+
+`current.json` is the machine-readable record of the task in flight. It is
+written by `skills/ai-task/state.py` (atomically), read by `/ai-status`, and
+enforced by `ai-scope-guard`, which derives the files the current step may touch
+from it.
+
+Two other writers exist, and only these two. A schema migration in
+`/project-update` may change the state through `ctx.patch_state()`, with the
+same atomic write and a `schema_migrated` history entry — that is how a task in
+flight survives a change to the shape of this file. And `hooks/context-guard.py`
+writes `session.json`, the sidecar beside this file, and nothing else: it never
+touches `current.json`. Nothing else writes any of it — an agent never edits
+them by hand, and the path guard refuses when one tries.
+
+It is **not committed**: it describes a session, not the repository. The
+`.gitignore` entry added by `/ai-init` keeps it out of git.
+
+When a task closes, `state.py close` writes the final state to
+`.ai/state/logs/<task-id>/state.json`, beside the task's verify logs — local,
+**not** committed. What is committed is `.ai/reports/<task-id>/events.jsonl`
+and `task.md`, and in packages mode the task's compact record under
+`.ai/memory/` — that is the audit trail: which stages ran, in what order, who
+approved what, and when (the plugin's `docs/local-memory.md`).
+
+It holds facts, never transcripts:
+
+```
+task_id, goal, workflow, risk_tier, current_stage, affected_modules,
+context_summary_ref, approved_plan { ref, current_step_id, steps[] },
+completed_steps, test_status, e2e_status, review_status, security_status, open_risks,
+next_action, owner_runtime, resume_point { stage, step_id, next_action, at, runtime },
+questions { file, pending[] }, handoff { file, written_at, reason },
+human_approval { required, granted, granted_by, granted_at,
+                 requested_at, gate_id, requested_session, rejected_at, via, unattended },
+created_at, updated_at, history[]
+```
+
+`state.py` applies the schema-2 keys in memory as it loads, so a project that has
+not run `/project-update` yet still answers every command; `save()` then writes
+them. A reader that opens this file directly sees what is on disk, not those
+defaults.
+
+## The other files beside it
+
+| File | Written by | Committed |
+|---|---|---|
+| `current.json` | `state.py`, and `update.py` during a migration | no |
+| `session.json` | `context-guard.py`, on SessionStart and each prompt | no |
+| `handoff.md` | `state.py handoff` — never a model | no |
+| `../reports/<task-id>/task.md` §Questions | `state.py ask/answer/questions` | yes |
+| `../reports/<task-id>/events.jsonl` | `state.py` (`emit`), append-only | yes |
+
+`handoff.md` is the ≤ 30-line frame a session that lost its context reads first:
+the goal, the next action and its resume point, the pending questions, the latest
+decisions, rejected options and failed attempts, and the user's last instruction
+verbatim. It is rendered from the four sources above, so deleting it loses
+nothing — the next stage-moving command writes it again.
+
+`events.jsonl` is the journal: one line per state change, `history[]`'s facts
+with types beside them. It is best effort by contract — a line that cannot be
+written never fails the command that emitted it — so nothing depends on it being
+complete, and readers skip a line they cannot parse.
+
+If this file is corrupt, `state.py` refuses to read it rather than replacing it.
+Inspect it by hand: the scope guard's boundaries come from here, and a silently
+regenerated state file means an unbounded implementer.

package/skills/project-update/history/blobs/5353ca529c46f2443e12947ec205a6887fb594a4de1f87f0eb1c0e6c0f826133

@@ -0,0 +1,49 @@
+{
+  "version": 1,
+  "axes": {
+    "scope": {"measure": "references", "bands": [0, 5], "hot_paths": ["hooks/**", "src/Shared/**"]},
+    "behaviour": {"measure": "session",
+                  "keywords": ["workflow", "transition", "state machine", "messenger", "queue", "async", "transaction"]},
+    "reversibility": {"measure": "paths+content",
+                      "needs_step": ["**/migrations/**", "**/Migrations/**", "config/**", "k8s/**", "**/env/**"],
+                      "irreversible": ["**/prod/**", "**/production/**", "deploy/**", "**/*.deploy.*"],
+                      "irreversible_content": ["DROP ", "TRUNCATE", "DELETE FROM", "ALTER .* DROP", "RENAME"]},
+    "domain": {"measure": "modules+session",
+               "modules": ["**/Payment/**", "**/Tax/**", "**/Invoice/**", "**/Security/**", "**/account/**"],
+               "customer_visible": ["templates/**", "**/Shop/**", "**/Resources/views/**"]},
+    "novelty": {"measure": "session",
+                "manifests": ["composer.json", "requirements*.txt", "package.json", "pyproject.toml", "Gemfile"]},
+    "coverage": {"measure": "tests-map",
+                 "code_globs": ["**/*.php", "**/*.py", "**/*.js", "**/*.ts", "**/*.sh"],
+                 "test_globs": ["tests/**", "spec/**", "**/*Test.php", "**/*.test.*", "**/*.spec.*", "**/test_*.py"],
+                 "map": {}}
+  },
+  "hints": [
+    {"paths": ["**/login*", "**/Security/**", "**/*Auth*"], "axis": "domain", "note": "auth-shaped path"},
+    {"paths": ["skills/project-update/migrations/**"], "axis": "reversibility", "note": "touches user trees"},
+    {"paths": [".ai/policies/**", ".claude/**", ".codex/**", "CLAUDE.md", "AGENTS.md"], "axis": "behaviour", "note": "pipeline"},
+    {"paths": ["composer.json", "package.json", "requirements*.txt"], "axis": "novelty", "note": "dependency manifest"}
+  ],
+  "modes": {
+    "light": {"max_w": 2, "plan": "inline", "review": "on_red_fact", "reviewer": "BALANCED",
+              "human_stops": 0, "suite": "verify", "e2e": false},
+    "guarded": {"max_w": 7, "plan": "plan_mode", "review": "one", "reviewer": "BALANCED",
+                "human_stops": 1, "suite": "verify+e2e", "e2e": true},
+    "full": {"min_w": 8, "hard_axes": ["reversibility", "domain"], "plan": "written", "review": "one",
+             "reviewer": "STRONG", "security_focus_when": "domain=2", "human_stops": 2, "suite": "verify+e2e", "e2e": true},
+    "full_irreversible": {"when": "reversibility=2 and domain=2, or irreversible_content",
+                          "human_stops": 3, "confirm_names_operation": true}
+  },
+  "rules": {"unknown_scores": 1, "hint_raises_by": 1, "hint_raises_once_per_axis": true,
+            "rescore_axes": ["reversibility", "domain"], "rescore_direction": "up", "lower_by": "human",
+            "steps_advice_over": 8},
+  "review_rounds_max": 2,
+  "remediation_rounds": 2,
+  "tests": {"max_suite_runs": 2, "timeout_seconds": 1800, "env_retries": 1, "log_max_bytes": 2097152},
+  "batch": {"default": false, "review_rounds_max": 3, "max_suite_runs": 8, "parallel": 3, "tier": "BALANCED"},
+  "examples": {
+    "light": ["a font or copy change in one template", "a test-only change", "a message-text change"],
+    "guarded": ["a regex fix in a hot guard script", "a dev-environment manifest", "a feature with a new screen and an additive migration"],
+    "full": ["a change in Payment/, Tax/ or Security/", "a migration that rewrites user trees", "a production manifest or secret"]
+  }
+}

package/skills/project-update/history/blobs/5f65bc7ab3fc3c4e75ae05d49eaf4331fafc398c661abe33c69f7380a720344c

@@ -0,0 +1,32 @@
+# Weight table
+
+<!-- generated by `state.py weight --mirror` from weight.json; edit the JSON and regenerate. sha256: 5353ca529c46f2443e12947ec205a6887fb594a4de1f87f0eb1c0e6c0f826133 -->
+
+Six axes, 0–2 each; W is their sum. Why each rule is what it is: the plugin's `docs/weight.md`.
+
+| Axis | Measured by | Table |
+|---|---|---|
+| scope | references | bands: [0, 5]; hot_paths: ["hooks/**", "src/Shared/**"] |
+| behaviour | session | keywords: ["workflow", "transition", "state machine", "messenger", "queue", "async", "transaction"] |
+| reversibility | paths+content | needs_step: ["**/migrations/**", "**/Migrations/**", "config/**", "k8s/**", "**/env/**"]; irreversible: ["**/prod/**", "**/production/**", "deploy/**", "**/*.deploy.*"]; irreversible_content: ["DROP ", "TRUNCATE", "DELETE FROM", "ALTER .* DROP", "RENAME"] |
+| domain | modules+session | modules: ["**/Payment/**", "**/Tax/**", "**/Invoice/**", "**/Security/**", "**/account/**"]; customer_visible: ["templates/**", "**/Shop/**", "**/Resources/views/**"] |
+| novelty | session | manifests: ["composer.json", "requirements*.txt", "package.json", "pyproject.toml", "Gemfile"] |
+| coverage | tests-map | code_globs: ["**/*.php", "**/*.py", "**/*.js", "**/*.ts", "**/*.sh"]; test_globs: ["tests/**", "spec/**", "**/*Test.php", "**/*.test.*", "**/*.spec.*", "**/test_*.py"]; map: {} |
+
+| Mode | When | Plan | Review | Reviewer | Human stops | Suite |
+|---|---|---|---|---|---|---|
+| light | W ≤ 2 | inline | on_red_fact | BALANCED | 0 | verify |
+| guarded | W ≤ 7 | plan_mode | one | BALANCED | 1 | verify+e2e |
+| full | W ≥ 8 or reversibility or domain = 2 | written | one | STRONG | 2 | verify+e2e |
+| full_irreversible | reversibility=2 and domain=2, or irreversible_content | as full | as full | as full | 3 | as full |
+
+| Hint paths | Axis | Note |
+|---|---|---|
+| `**/login*`, `**/Security/**`, `**/*Auth*` | domain +1 | auth-shaped path |
+| `skills/project-update/migrations/**` | reversibility +1 | touches user trees |
+| `.ai/policies/**`, `.claude/**`, `.codex/**`, `CLAUDE.md`, `AGENTS.md` | behaviour +1 | pipeline |
+| `composer.json`, `package.json`, `requirements*.txt` | novelty +1 | dependency manifest |
+
+Rules: {"unknown_scores": 1, "hint_raises_by": 1, "hint_raises_once_per_axis": true, "rescore_axes": ["reversibility", "domain"], "rescore_direction": "up", "lower_by": "human", "steps_advice_over": 8}
+
+Budgets: review_rounds_max 2 · remediation_rounds 2 · tests {"max_suite_runs": 2, "timeout_seconds": 1800, "env_retries": 1, "log_max_bytes": 2097152} · batch {"default": false, "review_rounds_max": 3, "max_suite_runs": 8, "parallel": 3, "tier": "BALANCED"}

package/skills/project-update/history/blobs/7be527cd648b27cca6e267de30f8e33a2ce17d5631a82694f23ae5c0623efe1f

@@ -0,0 +1,15 @@
+# Constitution — {{PROJECT}}
+
+<!-- The 10–15 principles this project does not negotiate, one line each, numbered C1…;
+     /sdlc-spec and the planner cite them. Under 15: what is not here lives in .ai/policies/. -->
+
+C1. Production behaviour is the source of truth; what looks wrong may be load-bearing.
+C2. A bugfix starts with the failing test; legacy behaviour gets a characterization test before it changes.
+C3. A refactoring changes no behaviour and is never mixed with a feature.
+C4. Every step names its files; scope grows only by amending the plan.
+C5. No agent merges or deploys; an agent commits, pushes or approves only by running, verbatim and once, a command a human picked in the dialog; otherwise a human runs it outside the agent.
+C6. <!-- project principle — filled by /ai-init from the survey, confirmed by you -->
+C7. <!-- project principle -->
+C8. <!-- project principle -->
+C9. <!-- project principle -->
+C10. <!-- project principle -->

package/skills/project-update/history/blobs/7ee99edafe7cec45ff577376c0d0178fdb2690134d4656488f46e129aba3cc5a

@@ -0,0 +1,67 @@
+# Task state
+
+`state.json` is the machine-readable record of the task in flight. It is
+written by `skills/ai-task/state.py` (atomically), read by `/ai-status`, and
+enforced by `ai-scope-guard`, which derives the files the current step may touch
+from it.
+
+Two other writers exist, and only these two. A schema migration in
+`/project-update` may change the state through `ctx.patch_state()`, with the
+same atomic write and a `schema_migrated` history entry — that is how a task in
+flight survives a change to the shape of this file. And `hooks/context-guard.py`
+writes `session.json`, the sidecar beside this file, and nothing else: it never
+touches `state.json`. Nothing else writes any of it — an agent never edits
+them by hand, and the path guard refuses when one tries.
+
+It is **not committed**: it describes a session, not the repository. The
+`.gitignore` entry added by `/ai-init` keeps it out of git.
+
+When a task closes, `state.py close` writes the final state to
+`.ai/state/logs/<task-id>/state.json`, beside the task's verify logs — local,
+**not** committed. What is committed is `.ai/reports/<task-id>/events.jsonl`
+and `task.md`, and in packages mode the task's compact record under
+`.ai/memory/` — that is the audit trail: which stages ran, in what order, who
+approved what, and when (the plugin's `docs/local-memory.md`).
+
+It holds facts, never transcripts:
+
+```
+task_id, goal, workflow, risk_tier, current_stage, affected_modules,
+context_summary_ref, approved_plan { ref, current_step_id, steps[] },
+completed_steps, test_status, e2e_status, review_status, security_status, open_risks,
+next_action, owner_runtime, resume_point { stage, step_id, next_action, at, runtime },
+questions { file, pending[] }, handoff { file, written_at, reason },
+human_approval { required, granted, granted_by, granted_at,
+                 requested_at, gate_id, requested_session, rejected_at, via, unattended },
+created_at, updated_at, history[]
+```
+
+`state.py` applies the schema-2 keys in memory as it loads, so a project that has
+not run `/project-update` yet still answers every command; `save()` then writes
+them. A reader that opens this file directly sees what is on disk, not those
+defaults.
+
+## The other files beside it
+
+| File | Written by | Committed |
+|---|---|---|
+| `state.json` (legacy `current.json`, still read) | `state.py`, and `update.py` during a migration | no |
+| `session.json` | `context-guard.py`, on SessionStart and each prompt | no |
+| `handoff.md` | `state.py handoff` — never a model | no |
+| `../reports/<task-id>/task.md` §Questions | `state.py ask/answer/questions` | yes |
+| `../reports/<task-id>/events.jsonl` | `state.py` (`emit`), append-only | yes |
+
+`handoff.md` is the ≤ 30-line frame a session that lost its context reads first:
+the goal, the next action and its resume point, the pending questions, the latest
+decisions, rejected options and failed attempts, and the user's last instruction
+verbatim. It is rendered from the four sources above, so deleting it loses
+nothing — the next stage-moving command writes it again.
+
+`events.jsonl` is the journal: one line per state change, `history[]`'s facts
+with types beside them. It is best effort by contract — a line that cannot be
+written never fails the command that emitted it — so nothing depends on it being
+complete, and readers skip a line they cannot parse.
+
+If this file is corrupt, `state.py` refuses to read it rather than replacing it.
+Inspect it by hand: the scope guard's boundaries come from here, and a silently
+regenerated state file means an unbounded implementer.

package/skills/project-update/history/blobs/8b3ef9586491a426767c01da5d01bdd6b0655c576c68c4cc6dfb093367817dc0

@@ -0,0 +1,67 @@
+# How agents work in this repository
+
+One `.ai/` tree serves every runtime — same pipeline, same tiers, same scope rule
+— and one task state under `state/`, so a task started in one runtime resumes in
+the other. Read the non-negotiables below, then only the row for what you are doing.
+Everything else loads on demand; nothing here is worth reading twice.
+
+## Non-negotiable (read even if you read nothing else)
+
+1. Production behaviour is the source of truth. Code that looks wrong may be
+   load-bearing: document what you find, change only what the task asked for.
+2. A change runs through `/rr-plan` and `/rr-build` (`using-riskrails.md`).
+   The task names the files it may touch; an edit outside them is refused —
+   answer `SCOPE_CHANGE_REQUIRED` and widen the task in place with
+   `state.py start --amend --files "+<path>" --why "…"`, never around the guard.
+3. No agent merges or deploys; commit, push, approval only as the dialog's picked
+   command, or the human runs them outside the agent.
+4. Verify before reporting done: the verification command once, to the end,
+   every failure fixed as one batch, the output shown. Run it through
+   `state.py verify --scope all` — it caps the runs, keeps the log out of the
+   context, and a green exit code needs no agent to interpret it.
+5. A refactoring changes no behaviour and is never mixed with a feature; legacy
+   behaviour without a test gets a characterization test first.
+6. Everything written into `project/` carries an evidence label — KNOWN FACT
+   with `file:line`, INFERENCE with what it came from, UNKNOWN, RISK. An
+   inference is never written as a fact.
+7. `docs/sdlc/constitution.md` is this project's own list of principles. Cite
+   them as `C<n>` in a spec, a plan or a review; say so in one line if it is
+   absent, and carry on.
+
+## Shared files
+
+This `.ai/` holds `project/`, `rules/`, `state/`, `reports/`, `VERSION` and, in
+`policies/`, `risk-tiers.json`, `risk-tiers.md`, `path-guard.json`, `testing.md`,
+`coding.md`, `safety.md` and `security.md`. Every other path below ships with the
+plugin at `<home>/riskrails/ai/<path>`; `<home>` is `~/.claude`, or
+`$CODEX_HOME` (default `~/.codex`). A file at the same path here overrides it and
+stops receiving its changes; `<home>/riskrails/ai-path <path>` prints the
+copy that applies.
+
+## Doing X → read Y
+
+| Doing | Read |
+|---|---|
+| anything, first | `policies/safety.md` |
+| which command when, the three modes | `using-riskrails.md` |
+| starting or resuming a task | `state.py handoff --print`, then `/rr-build` (no task: `/rr-plan`) |
+| the weight, the mode, who reviews, what a human approves | `policies/weight.json` (`policies/weight.md` mirrors it) |
+| choosing an agent or a tier | `policies/model-routing.md` |
+| writing code under `<dir>/` | `policies/coding.md`; `rules/<slug>.md` for that directory |
+| tests | `policies/testing.md` — Verification: the three commands, run by `state.py verify` |
+| finishing a step, verifying, recording a review, closing | `state.py step-done`, `verify`, `review`, `close` — the measurements are deterministic and the refusals name the way out |
+| schema, data, migrations | `policies/database.md`, `policies/production.md` |
+| auth, secrets, personal data, payments | `policies/security.md` |
+| git, release | `policies/git.md`, `policies/release.md` |
+| feature / bugfix / refactoring / hotfix / investigation | `workflows.md`, the section of that name |
+| acting as a role | `agents/<role>.md` |
+| an artefact | `templates/<artefact>.md` → `reports/<task-id>/` |
+| understanding the system | `project/overview.md`, then `project/*.md` |
+| principles, intent, spec, plan, decisions | `docs/sdlc/constitution.md`, `docs/sdlc/` |
+| the project is behind the plugin | `/project-update` (`VERSION` is this tree's schema) |
+
+## Keeping this directory true
+
+`project/` describes the system as it was last surveyed. When you discover that it
+is wrong, fix it in the same task — a knowledge base nobody trusts is worse than
+none. Re-run `/ai-init` after a large change to refresh it.

package/skills/project-update/history/blobs/917df3320d778ddbaa5c5c7742bc4046bf803c36ed2b050f30844ed206783469

@@ -0,0 +1 @@
+10

package/skills/project-update/history/blobs/935af1019931058ec3a0b834fe230e127ec914f75edcc4a6c589cfe733b0b979

@@ -0,0 +1,13 @@
+<!-- riskrails:start -->
+## AI agent workflow
+
+This repository runs an agentic pipeline under `.ai/`. Read `.ai/AGENTS.md` first: it routes to the policies, workflows and rules, which load on demand; `.ai/policies/` is binding.
+
+- Production behaviour is the source of truth: document problems outside the task, do not fix them.
+
+- Changes run through the pipeline (`/rr-build` in Claude Code or Codex); without it, follow `.ai/policies/safety.md`, touch only the files the current task names, and answer questions in prose or by filling the file.
+
+- Verify before reporting done: `verify_command` from `.ai/policies/testing.md` once, to the end, then `e2e_command` once; every failure fixed as one batch; show the output.
+- No agent merges or deploys; commit, push, approval only as the dialog picks, else a human outside. When a review flags the same mistake twice, the correction goes into this file.
+- Files, not chat, carry decisions: `.ai/reports/<task-id>/task.md` (answer by filling `[Answer]:`), `.ai/state/handoff.md` (read first when resuming), `docs/sdlc/constitution.md` (this project's principles).
+<!-- riskrails:end -->

package/skills/project-update/history/blobs/ae5ce131d6bae401199ff32d8c3dc4d8aec188010a9111624ac64506e2116ff4

@@ -0,0 +1,84 @@
+# Safety policy
+
+This is the file every agent reads first. It is short on purpose. It binds every
+agent in every runtime — Claude Code and Codex alike.
+
+## The one rule
+
+**Production behaviour is the source of truth until proven otherwise.** Code that
+looks wrong, dead, or badly written may be load-bearing. The repository's history
+is evidence; your intuition about how the code "should" look is not.
+
+## What an agent must never do
+
+- Change application code that the current task did not ask about.
+- Rename, move, reorganise or "clean up" anything as a side effect.
+- Remove code because it looks unused. Find the callers first; if there are none,
+  say so in the report and leave the code alone.
+- Combine a refactoring with a feature change in the same step.
+- Modify database schemas, dependencies or framework versions outside a task that
+  is explicitly about that.
+- Weaken a test, a linter rule or a static-analysis level to make a check pass.
+- Commit, push, merge or deploy on its own initiative.
+- Read production secrets or customer data into the model context.
+
+If you find a problem outside the current task: **write it down, do not fix it.**
+Unrelated findings are recorded with `state.py memory risk add` (in files mode it
+writes `.ai/project/known-risks.md`) or go into the report's "observations"
+section, and the human decides whether they become their own task.
+
+The compact record is the human's to switch: `state.py memory enable`, `disable`,
+`cleanup`, `pack`, `redact` and `migrate --move-logs` take the human route, as
+`approve` does, and `.ai/memory/` and `.ai/local/memory/` are written by
+`state.py` alone — an agent never edits them (`state.py memory --help`; the
+plugin's `docs/local-memory.md`).
+
+## Scope
+
+Every implementation step names the files it may touch. Editing anything else is
+refused by `ai-scope-guard` and must be answered with `SCOPE_CHANGE_REQUIRED`:
+stop, say which file you need and why, and let the plan be amended. A step whose
+scope keeps growing is a step that was planned wrong.
+
+`ai-git-guard`, `ai-path-guard` and `ai-scope-guard` all run in both runtimes. A
+multi-file edit in one call — Codex's `apply_patch` — is checked path by path, so
+a single out-of-scope or protected file rejects the whole patch. What a guard
+refuses is not a hint: do not reword the command to get past it.
+
+A guard is a backstop, not the policy. Some checks exist in only one runtime —
+Codex has no hookable read tool, so the large-read cap is Claude-only there — and
+an agent that behaves correctly only because a hook is watching is not behaving
+correctly. The rules above hold whether or not a hook enforces them.
+
+**The guards' threat model.** The guards defend against an agent's mistakes — a
+careless `rm`, a write to a frozen policy during a task, a commit with a
+secret — not against an agent that constructs a command to exhaust them. A
+command built to time the guard out is visible in the transcript and in the
+journal, and the human gate in full and full_irreversible mode is the boundary
+for anything that matters.
+Approval rests on a guard plus a ledger: a command the agent constructs to pass
+for the human's pick is outside the threat model, and `state.py consent audit`
+detects it afterwards.
+
+## Evidence labels
+
+Anything an agent writes into `.ai/project/` carries one of four labels:
+
+- **KNOWN FACT** — read from the code, a config file, a migration or a test.
+  Cite `file:line`.
+- **INFERENCE** — a conclusion drawn from facts. Say what it is drawn from.
+- **UNKNOWN** — something that matters and could not be determined. Say what
+  would answer it.
+- **RISK** — something that looks dangerous. Say what could go wrong.
+
+Never present an inference as a fact. When documentation and code disagree,
+record both under "Documented behaviour" and "Observed behaviour", with the
+evidence for each, and let the human decide which is the bug.
+
+## When in doubt
+
+Stop and ask. An agent that pauses costs a message; an agent that guesses on a
+payment path costs an incident.
+
+Doubt on reversibility or domain is a blocker; other doubt is written to
+`task.md` and the work continues.

package/skills/project-update/history/blobs/ca4499d829268c8766fb3b825a515e88dc55c237e9d202816b50959b4dac031f

@@ -0,0 +1,13 @@
+<!-- riskrails:start -->
+## AI agent workflow
+
+This repository runs an agentic pipeline under `.ai/`. Read `.ai/AGENTS.md` first: it routes to the policies, workflows and rules, which load on demand; `.ai/policies/` is binding.
+
+- Production behaviour is the source of truth: document problems outside the task, do not fix them.
+
+- A change runs through `/rr-build <request>`; `/rr-status` shows where it stands. Each step names the files it may touch — an edit outside them is refused: answer `SCOPE_CHANGE_REQUIRED`. One `apply_patch` is checked file by file: a patch that reaches outside the step is refused whole.
+
+- Verify before reporting done: `verify_command` from `.ai/policies/testing.md` once, to the end, then `e2e_command` once; every failure fixed as one batch; show the output.
+- No agent merges or deploys; commit, push, approval only as the dialog picks, else a human outside. When a review flags the same mistake twice, the correction goes into this file.
+- Files, not chat, carry decisions: `.ai/reports/<task-id>/task.md` (answer by filling `[Answer]:`), `.ai/state/handoff.md` (read first when resuming), `docs/sdlc/constitution.md` (this project's principles).
+<!-- riskrails:end -->

package/skills/project-update/history/blobs/e9adb7a9905eb719ac78ab96671f055da53e5001810f5ad6d6c94306b0323fe7

@@ -0,0 +1,74 @@
+# Safety policy
+
+This is the file every agent reads first. It is short on purpose. It binds every
+agent in every runtime — Claude Code and Codex alike.
+
+## The one rule
+
+**Production behaviour is the source of truth until proven otherwise.** Code that
+looks wrong, dead, or badly written may be load-bearing. The repository's history
+is evidence; your intuition about how the code "should" look is not.
+
+## What an agent must never do
+
+- Change application code that the current task did not ask about.
+- Rename, move, reorganise or "clean up" anything as a side effect.
+- Remove code because it looks unused. Find the callers first; if there are none,
+  say so in the report and leave the code alone.
+- Combine a refactoring with a feature change in the same step.
+- Modify database schemas, dependencies or framework versions outside a task that
+  is explicitly about that.
+- Weaken a test, a linter rule or a static-analysis level to make a check pass.
+- Commit, push, merge or deploy on its own initiative.
+- Read production secrets or customer data into the model context.
+
+If you find a problem outside the current task: **write it down, do not fix it.**
+Unrelated findings are recorded with `state.py memory risk add` (in files mode it
+writes `.ai/project/known-risks.md`) or go into the report's "observations"
+section, and the human decides whether they become their own task.
+
+The compact record is the human's to switch: `state.py memory enable`, `disable`,
+`cleanup`, `pack`, `redact` and `migrate --move-logs` take the human route, as
+`approve` does, and `.ai/memory/` and `.ai/local/memory/` are written by
+`state.py` alone — an agent never edits them (`state.py memory --help`; the
+plugin's `docs/local-memory.md`).
+
+## Scope
+
+Every implementation step names the files it may touch. Editing anything else is
+refused by `ai-scope-guard` and must be answered with `SCOPE_CHANGE_REQUIRED`:
+stop, say which file you need and why, and let the plan be amended. A step whose
+scope keeps growing is a step that was planned wrong.
+
+`ai-git-guard`, `ai-path-guard` and `ai-scope-guard` all run in both runtimes. A
+multi-file edit in one call — Codex's `apply_patch` — is checked path by path, so
+a single out-of-scope or protected file rejects the whole patch. What a guard
+refuses is not a hint: do not reword the command to get past it.
+
+A guard is a backstop, not the policy. Some checks exist in only one runtime —
+Codex has no hookable read tool, so the large-read cap is Claude-only there — and
+an agent that behaves correctly only because a hook is watching is not behaving
+correctly. The rules above hold whether or not a hook enforces them.
+
+## Evidence labels
+
+Anything an agent writes into `.ai/project/` carries one of four labels:
+
+- **KNOWN FACT** — read from the code, a config file, a migration or a test.
+  Cite `file:line`.
+- **INFERENCE** — a conclusion drawn from facts. Say what it is drawn from.
+- **UNKNOWN** — something that matters and could not be determined. Say what
+  would answer it.
+- **RISK** — something that looks dangerous. Say what could go wrong.
+
+Never present an inference as a fact. When documentation and code disagree,
+record both under "Documented behaviour" and "Observed behaviour", with the
+evidence for each, and let the human decide which is the bug.
+
+## When in doubt
+
+Stop and ask. An agent that pauses costs a message; an agent that guesses on a
+payment path costs an incident.
+
+Doubt on reversibility or domain is a blocker; other doubt is written to
+`task.md` and the work continues.

package/skills/project-update/history/blobs/fae3064e648cdc55be4aeb1177525b302a5e34ebd752e4a904f47dc0f4557b96

@@ -0,0 +1,71 @@
+# Safety policy
+
+This is the file every agent reads first. It is short on purpose. It binds every
+agent in every runtime — Claude Code and Codex alike.
+
+## The one rule
+
+**Production behaviour is the source of truth until proven otherwise.** Code that
+looks wrong, dead, or badly written may be load-bearing. The repository's history
+is evidence; your intuition about how the code "should" look is not.
+
+## What an agent must never do
+
+- Change application code that the current task did not ask about.
+- Rename, move, reorganise or "clean up" anything as a side effect.
+- Remove code because it looks unused. Find the callers first; if there are none,
+  say so in the report and leave the code alone.
+- Combine a refactoring with a feature change in the same step.
+- Modify database schemas, dependencies or framework versions outside a task that
+  is explicitly about that.
+- Weaken a test, a linter rule or a static-analysis level to make a check pass.
+- Commit, push, merge or deploy on its own initiative.
+- Read production secrets or customer data into the model context.
+
+If you find a problem outside the current task: **write it down, do not fix it.**
+Unrelated findings are recorded with `state.py memory risk add` (in files mode it
+writes `.ai/project/known-risks.md`) or go into the report's "observations"
+section, and the human decides whether they become their own task.
+
+The compact record is the human's to switch: `state.py memory enable`, `disable`,
+`cleanup`, `pack`, `redact` and `migrate --move-logs` take the human route, as
+`approve` does, and `.ai/memory/` and `.ai/local/memory/` are written by
+`state.py` alone — an agent never edits them (`state.py memory --help`; the
+plugin's `docs/local-memory.md`).
+
+## Scope
+
+Every implementation step names the files it may touch. Editing anything else is
+refused by `ai-scope-guard` and must be answered with `SCOPE_CHANGE_REQUIRED`:
+stop, say which file you need and why, and let the plan be amended. A step whose
+scope keeps growing is a step that was planned wrong.
+
+`ai-git-guard`, `ai-path-guard` and `ai-scope-guard` all run in both runtimes. A
+multi-file edit in one call — Codex's `apply_patch` — is checked path by path, so
+a single out-of-scope or protected file rejects the whole patch. What a guard
+refuses is not a hint: do not reword the command to get past it.
+
+A guard is a backstop, not the policy. Some checks exist in only one runtime —
+Codex has no hookable read tool, so the large-read cap is Claude-only there — and
+an agent that behaves correctly only because a hook is watching is not behaving
+correctly. The rules above hold whether or not a hook enforces them.
+
+## Evidence labels
+
+Anything an agent writes into `.ai/project/` carries one of four labels:
+
+- **KNOWN FACT** — read from the code, a config file, a migration or a test.
+  Cite `file:line`.
+- **INFERENCE** — a conclusion drawn from facts. Say what it is drawn from.
+- **UNKNOWN** — something that matters and could not be determined. Say what
+  would answer it.
+- **RISK** — something that looks dangerous. Say what could go wrong.
+
+Never present an inference as a fact. When documentation and code disagree,
+record both under "Documented behaviour" and "Observed behaviour", with the
+evidence for each, and let the human decide which is the bug.
+
+## When in doubt
+
+Stop and ask. An agent that pauses costs a message; an agent that guesses on a
+payment path costs an incident.