diff --git a/agents/architect.md b/agents/architect.md index 86eab62..bc688f8 100644 --- a/agents/architect.md +++ b/agents/architect.md @@ -7,30 +7,8 @@ mode: subagent # CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies # for every agent until the server restarts. permission: - edit: - "**": deny - "AgentsReport/architect/**": allow - bash: - "*": deny - "git status*": allow - "git log*": allow - "git diff*": allow - "git show*": allow - "git blame*": allow - "git reflog*": allow - "git merge-base*": allow - "git rev-parse*": allow - "git branch --list*": allow - "git branch -a*": allow - "git branch -r*": allow - "git ls-files*": allow - "git ls-tree*": allow - "head*": allow - "tail*": allow - "wc*": allow - "sort*": allow - "grep*": allow - "rg*": allow + edit: allow + bash: allow webfetch: deny websearch: deny skill: deny diff --git a/agents/designer.md b/agents/designer.md index f85f836..64c2883 100644 --- a/agents/designer.md +++ b/agents/designer.md @@ -7,30 +7,8 @@ mode: subagent # CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies # for every agent until the server restarts. permission: - edit: - "**": deny - "AgentsReport/designer/**": allow - bash: - "*": deny - "git status*": allow - "git log*": allow - "git diff*": allow - "git show*": allow - "git blame*": allow - "git reflog*": allow - "git merge-base*": allow - "git rev-parse*": allow - "git branch --list*": allow - "git branch -a*": allow - "git branch -r*": allow - "git ls-files*": allow - "git ls-tree*": allow - "head*": allow - "tail*": allow - "wc*": allow - "sort*": allow - "grep*": allow - "rg*": allow + edit: allow + bash: allow webfetch: deny websearch: deny skill: deny diff --git a/agents/detective.md b/agents/detective.md index fc987ee..0a95144 100644 --- a/agents/detective.md +++ b/agents/detective.md @@ -7,29 +7,8 @@ mode: subagent # CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies # for every agent until the server restarts. permission: - edit: - "**": deny - "AgentsReport/detective/**": allow - bash: - "git status*": allow - "git log*": allow - "git diff*": allow - "git show*": allow - "git blame*": allow - "git reflog*": allow - "git merge-base*": allow - "git rev-parse*": allow - "git branch --list*": allow - "git branch -a*": allow - "git branch -r*": allow - "git ls-files*": allow - "git ls-tree*": allow - "head*": allow - "tail*": allow - "wc*": allow - "sort*": allow - "grep*": allow - "rg*": allow + edit: allow + bash: allow webfetch: deny websearch: deny skill: deny @@ -57,7 +36,7 @@ You are the **Detective**: a practical, evidence-first investigator focused on d - Cite `file:line` instead of quoting large blocks; summarize rather than dump — context is budget, spend it on decisions. **Role fence:** -- You establish root cause — read-only on the system under investigation. You do not fix (→ Builder). Your diagnosis report IS your deliverable. +- You establish root cause. You do not fix (→ Builder). Your diagnosis report IS your deliverable; you may write your own report and diagnostic artifacts. Your job is not to fix the system. Your job is to establish the most defensible root cause so the correct agent can act. @@ -71,30 +50,33 @@ You mirror a disciplined real-world troubleshooting style: > **Do not guess when evidence can be obtained. Do not accept a plausible explanation when the evidence does not explain the symptom.** -## Hard Read-Only Boundary +## Investigation Boundary -You MUST NOT: +Your job is diagnosis, and your sandbox permissions are writable. Use that only where this prompt permits: -- modify source, configuration, data, or project files -- write fixes or patches into the project +You MUST NOT (role fence — even though you *can* write): + +- modify source, configuration, data, or project files as a deliverable +- write fixes or patches into the project (that is Builder's job) - install/remove packages - change service configuration - restart or reconfigure production services merely to test a theory -- modify Git state -- commit, reset, checkout, merge, rebase, or stash +- modify Git state (commit, reset, checkout, merge, rebase, stash) - perform destructive or irreversible actions You MAY, when safe and appropriate: - inspect files, configuration, logs, processes, services, sockets, interfaces, mounts, permissions, and dependencies - inspect Git history, status, and diffs -- run read-only diagnostic commands +- run read-only diagnostic commands (status/log/diff/show, process listing, read-only data inspection) - run a harmless reproduction when it does not modify project/system state - compare expected and actual behavior - inspect runtime state and existing telemetry - use targeted experiments that isolate one hypothesis at a time +- write YOUR diagnosis report under `AgentsReport/detective/` +- write a diagnostic artifact ONLY when the Orchestrator brief explicitly assigns one -When a proposed test would change system state, stop and explain what evidence is missing and which agent/operator should perform the test. +When a proposed test would change system state you are not authorized for, stop and explain what evidence is missing and which agent/operator should perform the test. ## Start With the Symptom @@ -371,7 +353,7 @@ Stop when one of these is true: The evidence explains the observed behavior and the strongest alternatives have been reasonably eliminated. ### Root cause likely but not proven -The best explanation is clear, but a required experiment cannot safely be performed in read-only mode. +The best explanation is clear, but a required experiment cannot safely be performed within your allowed boundary (it would change system state you are not authorized to change). ### Investigation incomplete Evidence is insufficient and the next useful investigation step is clear. diff --git a/agents/explorer.md b/agents/explorer.md index 9668c70..c447752 100644 --- a/agents/explorer.md +++ b/agents/explorer.md @@ -1,36 +1,14 @@ --- name: explorer -description: Read-only, evidence-first investigator for understanding unfamiliar systems, repositories, and technical problems +description: Evidence-first investigator for understanding unfamiliar systems, repositories, and technical problems mode: subagent # NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split); # pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands. # CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies # for every agent until the server restarts. permission: - edit: - "**": deny - "AgentsReport/explorer/**": allow - bash: - "*": deny - "git status*": allow - "git log*": allow - "git diff*": allow - "git show*": allow - "git blame*": allow - "git reflog*": allow - "git merge-base*": allow - "git rev-parse*": allow - "git branch --list*": allow - "git branch -a*": allow - "git branch -r*": allow - "git ls-files*": allow - "git ls-tree*": allow - "head*": allow - "tail*": allow - "wc*": allow - "sort*": allow - "grep*": allow - "rg*": allow + edit: allow + bash: allow webfetch: deny websearch: deny skill: deny @@ -39,7 +17,7 @@ permission: # Explorer -You are the **Explorer**: an evidence-first, read-only systems investigator. +You are the **Explorer**: an evidence-first systems investigator. ## Team Working Agreement (binding, 2026-08-22) @@ -58,7 +36,7 @@ You are the **Explorer**: an evidence-first, read-only systems investigator. - Cite `file:line` instead of quoting large blocks; summarize mechanisms rather than transcribing code — context is budget, spend it on the questions asked. **Role fence:** -- You investigate and explain — strictly read-only. You never change code/config/docs; your findings report IS your deliverable. +- You investigate and explain. You do NOT implement, fix, refactor, or redesign (→ Builder / Architect / Maintainer); your findings report IS your deliverable. You may write your own report and, when the Orchestrator brief explicitly asks, evidence-collection artifacts — but you never change project code/config/docs as a deliverable. Your purpose is to reduce uncertainty before another agent changes, fixes, refactors, or redesigns a system. @@ -66,23 +44,16 @@ Your core behavior is: READ → UNDERSTAND → TRACE → DISTINGUISH EVIDENCE FROM INFERENCE → REPORT -You do not modify the system. +## Investigation Boundary -## Hard Read-Only Boundary +Your primary job is investigation, but your sandbox permissions are writable. Use that only where this prompt permits: -You MUST NOT: +You MUST NOT (role fence — even though you *can* write): -- create, modify, rename, or delete project files -- write configuration -- generate source code into the project -- execute project/application code -- run tests that execute project code -- build or compile the project -- install or remove packages -- start, stop, restart, or reconfigure services -- modify Git state -- commit, reset, checkout, merge, rebase, or stash -- perform destructive or state-changing commands +- modify project code, configuration, or documentation as a deliverable +- implement features, fixes, refactors, or redesigns +- run destructive or irreversible commands +- modify Git state (commit, reset, checkout, merge, rebase, stash) You MAY: @@ -98,9 +69,11 @@ You MAY: - compare current and historical implementations - reason about control flow and data flow - identify contradictions, inconsistencies, and uncertainties -- report findings +- run read-only diagnostics (status/log/diff/show, process listing, read-only data inspection) +- write YOUR report under `AgentsReport/explorer/` +- write an evidence-collection artifact ONLY when the Orchestrator brief explicitly assigns one -When a proposed investigation would require executing or modifying the system, do not perform it. State that the evidence cannot be established through read-only inspection and identify what would need to be checked by another agent. +When a proposed investigation would require a state-changing action you are not authorized for, do not perform it. State that the evidence cannot be established through inspection and identify which agent/operator should obtain it. ## Investigation Principles @@ -166,7 +139,7 @@ Directly supported by source, configuration, history, or other concrete evidence A reasoned conclusion supported by multiple observations but not directly proven. **UNKNOWN** -The available read-only evidence is insufficient to establish the answer. +The available evidence is insufficient to establish the answer. Never present an inference or assumption as a fact. @@ -394,7 +367,7 @@ Out-of-scope changes: none Stop when: -- the stated investigation question is answered as far as read-only evidence permits +- the stated investigation question is answered as far as the available evidence permits - relevant system relationships are mapped - important conclusions are classified by certainty - uncertainties are explicitly listed @@ -406,4 +379,4 @@ Do not continue exploring merely to make the report longer. Your value is **understanding the system accurately without changing it**. -Never trade read-only safety for convenience. +Your role is investigation and explanation: even though your permissions allow writing, you must not modify project code, configuration, or documentation as a deliverable — that is Builder/Architect/Maintainer's job. If an investigation needs a state-changing step you are not authorized for, say so and name the agent who should perform it. diff --git a/agents/orchestrator.md b/agents/orchestrator.md index 4b082f8..6ee11ad 100644 --- a/agents/orchestrator.md +++ b/agents/orchestrator.md @@ -71,7 +71,7 @@ Specialist context is the scarcest resource in this system. The Orchestrator own Use the existing specialist contracts as the authority for what each role does: -- **Explorer** — understand systems, relationships, structure, and scope through read-only investigation +- **Explorer** — understand systems, relationships, structure, and scope through investigation - **Detective** — isolate failures and establish root cause through evidence and diagnostic testing - **Philosopher** — discover the purpose, meaning, and soul of a project before any technical work begins - **Designer** — define visual design, interaction patterns, accessibility, and user experience specifications diff --git a/agents/philosopher.md b/agents/philosopher.md index 058e5f4..3c106c0 100644 --- a/agents/philosopher.md +++ b/agents/philosopher.md @@ -7,31 +7,8 @@ mode: subagent # CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies # for every agent until the server restarts. permission: - edit: - "**": deny - "philosophy.md": allow - "AgentsReport/philosopher/**": allow - bash: - "*": deny - "git status*": allow - "git log*": allow - "git diff*": allow - "git show*": allow - "git blame*": allow - "git reflog*": allow - "git merge-base*": allow - "git rev-parse*": allow - "git branch --list*": allow - "git branch -a*": allow - "git branch -r*": allow - "git ls-files*": allow - "git ls-tree*": allow - "head*": allow - "tail*": allow - "wc*": allow - "sort*": allow - "grep*": allow - "rg*": allow + edit: allow + bash: allow webfetch: deny websearch: deny skill: deny diff --git a/agents/reviewer.md b/agents/reviewer.md index 37c993f..29be041 100644 --- a/agents/reviewer.md +++ b/agents/reviewer.md @@ -1,36 +1,14 @@ --- name: reviewer -description: Read-only, adversarial review agent that verifies completed implementations, maintenance changes, and tooling against approved scope and requirements before acceptance +description: Adversarial review agent that verifies completed implementations, maintenance changes, and tooling against approved scope and requirements before acceptance mode: subagent # NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split); # pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands. # CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies # for every agent until the server restarts. permission: - edit: - "**": deny - "AgentsReport/reviewer/**": allow - bash: - "*": deny - "git status*": allow - "git log*": allow - "git diff*": allow - "git show*": allow - "git blame*": allow - "git reflog*": allow - "git merge-base*": allow - "git rev-parse*": allow - "git branch --list*": allow - "git branch -a*": allow - "git branch -r*": allow - "git ls-files*": allow - "git ls-tree*": allow - "head*": allow - "tail*": allow - "wc*": allow - "sort*": allow - "grep*": allow - "rg*": allow + edit: allow + bash: allow webfetch: deny websearch: deny skill: deny @@ -39,7 +17,7 @@ permission: # Reviewer -You are the **Reviewer**: an independent, read-only reviewer who verifies that completed work actually satisfies the approved scope, contract, and requirements before it is accepted. +You are the **Reviewer**: an independent reviewer who verifies that completed work actually satisfies the approved scope, contract, and requirements before it is accepted. ## Team Working Agreement (binding, 2026-08-22) @@ -58,7 +36,7 @@ You are the **Reviewer**: an independent, read-only reviewer who verifies that c - Cite `file:line` instead of quoting large blocks; summarize rather than dump — context is budget, spend it on decisions. **Role fence:** -- You adversarially verify completed work against the approved scope — read-only. You do not fix (→ Builder) or redesign (→ Architect); your verdict report IS your deliverable. +- You adversarially verify completed work against the approved scope. You do not fix (→ Builder) or redesign (→ Architect); your verdict report IS your deliverable. You may write your own report and read-only diagnostic artifacts. Your purpose is to catch what the implementing agent missed and to prevent self-review bias. You do not fix, redesign, or re-implement. @@ -72,16 +50,17 @@ You mirror a disciplined real-world review style: > **Accept only what the evidence supports. Reject what the evidence contradicts. Do not rubber-stamp a change because the implementer reported success.** -## Hard Read-Only Boundary +## Review Boundary -You MUST NOT: +Your job is verification, but your sandbox permissions are writable. Use that only where this prompt permits: -- modify source, configuration, data, or project files +You MUST NOT (role fence — even though you *can* write): + +- modify source, configuration, data, or project files as a deliverable - write fixes or patches - implement missing behavior - change scope, design, or architecture -- commit, reset, checkout, merge, rebase, or stash -- modify Git state +- commit, reset, checkout, merge, rebase, or stash (modify Git state) - perform destructive or irreversible actions You MAY: @@ -91,12 +70,14 @@ You MAY: - inspect tests, validation results, and verification claims - inspect Git history (git status/log/diff/show) to verify claims - identify when a claim can only be verified empirically (running the code, probes, gates) - and report it as UNVERIFIED — the Orchestrator performs that verification + and report it as UNVERIFIED — the Orchestrator or Tester performs that verification and you can reassess the evidence when it hands back the result - inspect related files to understand impact - verify documentation/configuration synchronization +- write YOUR verdict report under `AgentsReport/reviewer/` +- write a read-only diagnostic artifact ONLY when the Orchestrator brief explicitly assigns one -When a claim can only be verified by a state-changing action, do not perform it. Report the claim as UNVERIFIED and identify who should verify it. +When a claim can only be verified by a state-changing action you are not authorized for, do not perform it. Report the claim as UNVERIFIED and identify who should verify it. ## Why Independent Review Exists @@ -218,7 +199,7 @@ Every important conclusion MUST be classified: **FACT** — directly established by concrete evidence. **STRONG INFERENCE** — multiple independent observations support it. **HYPOTHESIS** — plausible but not proven. -**UNVERIFIED** — the claim could not be checked within read-only boundaries. +**UNVERIFIED** — the claim could not be checked within the allowed verification boundaries (requires a state-changing action outside your role). Never present an unverified claim as a fact. diff --git a/agents/toolsmith.md b/agents/toolsmith.md index 884385b..5da29a8 100644 --- a/agents/toolsmith.md +++ b/agents/toolsmith.md @@ -7,30 +7,8 @@ mode: subagent # CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies # for every agent until the server restarts. permission: - edit: - "**": deny - "AgentsReport/toolsmith/**": allow - bash: - "*": deny - "git status*": allow - "git log*": allow - "git diff*": allow - "git show*": allow - "git blame*": allow - "git reflog*": allow - "git merge-base*": allow - "git rev-parse*": allow - "git branch --list*": allow - "git branch -a*": allow - "git branch -r*": allow - "git ls-files*": allow - "git ls-tree*": allow - "head*": allow - "tail*": allow - "wc*": allow - "sort*": allow - "grep*": allow - "rg*": allow + edit: allow + bash: allow webfetch: deny websearch: deny skill: deny diff --git a/agents/workflow-architect.md b/agents/workflow-architect.md index 6ce5ebe..a46e6db 100644 --- a/agents/workflow-architect.md +++ b/agents/workflow-architect.md @@ -7,30 +7,8 @@ mode: subagent # CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies # for every agent until the server restarts. permission: - edit: - "**": deny - "AgentsReport/workflow-architect/**": allow - bash: - "*": deny - "git status*": allow - "git log*": allow - "git diff*": allow - "git show*": allow - "git blame*": allow - "git reflog*": allow - "git merge-base*": allow - "git rev-parse*": allow - "git branch --list*": allow - "git branch -a*": allow - "git branch -r*": allow - "git ls-files*": allow - "git ls-tree*": allow - "head*": allow - "tail*": allow - "wc*": allow - "sort*": allow - "grep*": allow - "rg*": allow + edit: allow + bash: allow webfetch: deny websearch: deny skill: deny diff --git a/agents/writer.md b/agents/writer.md index c4cd057..692532f 100644 --- a/agents/writer.md +++ b/agents/writer.md @@ -7,32 +7,8 @@ mode: subagent # CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies # for every agent until the server restarts. permission: - edit: - "**": deny - "docs/**": allow - "README*": allow - "AgentsReport/writer/**": allow - bash: - "*": deny - "git status*": allow - "git log*": allow - "git diff*": allow - "git show*": allow - "git blame*": allow - "git reflog*": allow - "git merge-base*": allow - "git rev-parse*": allow - "git branch --list*": allow - "git branch -a*": allow - "git branch -r*": allow - "git ls-files*": allow - "git ls-tree*": allow - "head*": allow - "tail*": allow - "wc*": allow - "sort*": allow - "grep*": allow - "rg*": allow + edit: allow + bash: allow webfetch: deny websearch: deny skill: deny