AGENTS.md

Contents

• src/ – portable declarative and imperative workflow SDKs, host-resource admission, diagrams, direct Vercel AI Gateway generation, local vectorization, semantic operations, MCP, and canvas integration.
• apps/desktop/ – the canonical atet CLI, complete local media host, durable scheduler, HTML and Three.js overlays, native capture helpers, frontend, and desktop shell.
• apps/web/ – the static atet.sh site, with a local browser bundle and a production-only anonymous pageview boundary but no API, account, or credential surface.
• packages/scene/ – the shared local scene-analysis contract.
• src/code/ – portable declarative graph authoring, the closed public capability projection, compilation, planning, and execution contracts.
• schema/ – version-one diagram JSON Schema.
• skills/atet/ – the canonical Atet Agent Skill.
• .agents/skills/ – portable repository orchestration and knowledge-base workflows.
• kb/ – the Git-backed Markdown vault for rationale, evidence, maintained synthesis, plans, and scoped agent context.
• examples/ – checked diagram, configuration, and executable imperative and declarative Bun workflow examples.
• scripts/ – schema, skill, package, release, and official-vectorizer verification.
• dist/ and apps/desktop/dist/cli/ – committed Bun-targeted entrypoints consumed by package and Git installs.
• .github/workflows/ – routed SDK, local-host, static-site, macOS-native, official VTracer, and immutable release checks.
• docs/ – current architecture, npm publication, and Vercel provider runbooks.
• README.md, CONTRIBUTING.md, SECURITY.md, LICENSE, and NOTICE.md – public documentation, policy, and terms.
• WRITING.md and STYLE.md – internal and public prose contracts.
• package.json, tsconfig.json, and bun.lock – standalone package and verification configuration.

Guidelines

• Use Bun 1.3.14 and run bun run check before handing off a change.
• Follow WRITING.md for internal prose and STYLE.md for public prose, preserving facts, exact terms, literals, quotations, links, and necessary uncertainty.
• Follow the shared README guidelines for the root README and any site copy that summarizes it.
• Apply unreasonably robust programming when agent work is cheap. Prefer coherent cross-file correctness and focused deterministic evidence while treating production risk, provider coordination, rollout, and observation as real costs.
• Deliver changes to main through a current-head pull request. Keep the stable Required CI job green, resolve every review thread, and serialize merges. Human approval stays optional while one regular maintainer would otherwise self-review. Never force-push or bypass the gate.
• Keep this repository independently buildable. Never depend on sibling paths, Git submodules, or coordinated main branches; consume external Hraness packages only through reviewed immutable release tags or commits.
• Extract a shared package only after a second concrete consumer proves a stable product-neutral contract. Shared packages never import product code.
• Keep Atet's product and editor presentation local. Add @hraness/ui for portable accessible primitives or @hraness/design-kit for optional shared presentation only after concrete reuse warrants the dependency; domain layout and content remain Atet-owned.
• Freeze shared interfaces before parallel lanes begin. Give one integration owner manifests, lockfiles, generated registries, and other convergence files, then let consumers upgrade immutable releases independently.
• Keep mandatory edit-time rules in the closest AGENTS.md, current procedures in docs/, executable contracts in types, schemas, and tests, and rationale, evidence, synthesis, and plans in kb/. KB lanes run bun run kb:check:lane; the integrator performs one refresh and bun run kb:check.
• Keep @hraness/atet at the repository root. The root package owns both the portable SDK and canonical atet binary built from apps/desktop/cli/main.ts.
• Keep canonical commands namespaced as atet diagram init|check|render, atet image generate|vectorize, and the code, mcp, canvas, skill, and doctor surfaces.
• Keep local vectorization authentication-free and network-silent. Gateway generation reads AI_GATEWAY_API_KEY before VERCEL_OIDC_TOKEN, never persists credentials, pins the Gateway origin, bounds responses, and sets maxRetries: 0.
• Keep /artifacts/, .env, and .env.* ignored. Recordings, imported media, private project metadata, Gateway tokens, and provider options must never enter Git or a package artifact.
• Treat vercel env run -- <command> as the ergonomic local Vercel path. Never shell out to infer or scrape a token from the Vercel CLI.
• Treat Production as Atet's only durable Vercel environment. Do not create a custom environment, persistent Preview domain, or provider-authoritative Preview branch. Pull requests may use Vercel's built-in disposable Preview target, without production-only variables or another durable backend. Follow the Vercel runbook and audit provider identity before changing this seam.
• Preserve .diagram.json version one and the five same-stem render outputs: .tldr, light and dark SVG, and light and dark PNG.
• Keep one self-contained Atet identity. Public APIs, serialized identifiers, source imports, configuration, and runtime surfaces use only Atet names.
• Preserve every immutable version-1 tag and Release. Never rewrite a historical tag or recreate a repository at the former GitHub path, because doing so would replace GitHub's compatibility redirect.
• Treat diagram source as authoritative and generated media as replaceable. Defaults may resolve mechanics but must not invent claims, labels, legends, relationships, or decorative meaning.
• Model invalid states out, parse foreign values from unknown, and keep output deterministic. Preserve readable regression examples; add property tests for laws, parsers, reducers, ordering, and round trips, and promote shrunk failures into named deterministic examples.
• Keep semantic registries fixed and typed. Never accept source text, evaluation, dynamic imports, executable workspace configuration, shell commands, or caller-selected remote URLs.
• Preserve the root module and ./workflow v0.8 imperative APIs. Add declarative graphs through ./code and lower-level compiler contracts through ./code/advanced; do not add ./code/testing or ./code/workflows exports.
• Treat explicitly imported workflow modules as trusted current-user Bun code. Compile graphs only against the host's closed capability projection, reject an unsupported capability before executor or resource admission, and do not add an open operation-registration hook.
• Treat the portable SDK and core as the canonical graph contract. The complete local host consumes that contract through its own closed projection and owns durable media execution. The Desktop shell adds only native capture, permissions, and UI.
• Model one project as immutable source plus explicit revisions, candidates, selections, and delivery variants. Keep ready work bounded by resource claims and serialize expensive encodes by default.
• Keep imperative workflows as explicitly imported trusted Bun modules over the fixed operation registry. Parse runtime input, bound and uniquely identify steps, drain dispatched work before returning, retain completed-step receipts on every failure path, and do not load caller-selected source paths.
• Keep semantic SDK, CLI, MCP, and workflow resource admission machine-global and crash-safe on macOS and Linux, with a truthful process-local fallback elsewhere. Preserve profile identity, FIFO admission for overlapping claims, callback-settlement ownership, and inherited lease descriptors through spawned vectorizer processes.
• Keep MCP paths root-relative and capability-small. Bound source bytes, arrays, shapes, edges, scale, pixels, findings, subprocess duration, and output bytes before execution.
• Keep vectorization fail-closed with checksum-pinned VTracer archives, inert rebuilt SVG, measured fidelity, and full provenance receipts. Do not add an embedded-raster fallback, upscaling model, or bundled commercial font.
• Follow docs/publishing.md for the historical bootstrap and later releases. Preserve contentPolicy.class=dual-use and the root DISCLOSURE in every package. Trust only .github/workflows/npm-stage.yml with npm stage publish permission bound to the exact npm-stage environment. Keep that environment restricted solely to selected main, with administrator bypass disabled, no required deployment reviewers, and no secrets. Pushes and default dispatches build and upload without OIDC; only an owner current-main dispatch with boolean publish_to_npm=true may admit the staging job, which must reauthorize the exact run attempt, owner actor and triggering_actor, workflow/repository identity, protected ref, and source before npm setup. The packed manifest must not contain npm's top-level tag override, and publishConfig must contain exactly canonical public access and registry; independently parse the exact USTAR archive and reject every scoped-registry, proxy, authentication, tag, provenance, or other packed npm override in the OIDC job. Keep the source/release and checkout-free tar readers aligned on the exact eight-byte USTAR signature and byte-475 130/155 prefix semantics, with shared hostile fixtures. Stage only a stable candidate newer than live public latest; use empty user/global npm configuration, reject ambient npm_config_tag, prove pinned npm's untouched default tag is latest, and do not pass --tag so npm's built-in monotonic-latest guard remains active. npm supports multiple pending stages, exposes no atomic single-pending option, and does not authorize npm stage list with the short-lived trusted-publishing token. Keep this workflow the sole staging authority: serialize dispatches, inspect recognized terminal mutation steps before any stage-job display-name filter, record a successful version-bound Actions intent immediately before each mutation attempt, require every attempted terminal write to have exactly one successful durable intent at the immediately preceding safe positive Actions step number, and reject unresolved intents across every retained attempt of the current and completed runs while their version remains newer than public latest. A failed, ambiguous, or rejected stage attempt may release only its exact intent through the exceptional owner-authorized resolved_stage_version input after its provider state is resolved; a promoted stage advances latest and releases its intent automatically. Leave the input empty normally. The one-pending-stage rule is an operational invariant for this authority, not a claim that npm prevents or exposes out-of-band concurrent stages to OIDC. Disallow traditional publishing tokens. npm's public promotion remains human-gated by two-factor authentication.
• Use two exact active rulesets matching refs/tags/v*: Immutable version tags restricts update and deletion with an empty bypass list, while Release tag creation restricts creation and has owner User ID 894119 as its sole always-bypass actor. Never grant generic GitHub Actions integration ID 15368, an administrator, a repository role, a team, or another integration this bypass; never combine creation with update/delete or create probe tags. Publish and verify the exact staged npm artifact first, approve its public promotion with human 2FA, then run bun run ./scripts/push-npm-release-tag.ts <exact-stable-version> from clean current main; that preflight-only creator must read back owner/repository/rulesets/environment/protected-main/CI/public-latest/remote-tag identity before its sole exact annotated-tag push and must never publish npm. The protected tag workflow must bind actor and event sender to owner User ID 894119 and repository ID 1310516748 before checkout, require exact public dist-tags.latest, registry signatures, and npm-audit-verified npm-publish plus SLSA attestations bound to the tarball, source SHA, npm-stage.yml on main, workflow_dispatch, repository and owner IDs, GitHub-hosted builder, and signed stage run attempt. Immediately before the immutable Latest Release, re-read that exact owner-triggered attempt and its version-bound job, require one successful durable intent directly before the attempted npm mutation, and re-read live npm latest, integrity, signatures, and attestations. Do not require whole-job success: a failed, cancelled, or timed-out runner may have completed the provider write, and the exact cryptographically verified public provenance is the durable acceptance proof. Bind the Release body to the exact workflow, repository, tag, source, stage attempt, integrity, and attestation; accept an existing Release only from GitHub Actions bot ID 41898282 with that exact provenance and title. Never move a tag or republish an npm version.

• Treat the user's request to change this repository as standing authorization for routine task-owned commits, pushes, pull requests, merges, releases, deployments, and production verification after the repository's required validation, review, identity, and rollout gates pass. Do not ask for another confirmation at each delivery step.
• Use the repository's documented delivery workflow and preserve every runtime-enforced approval, branch protection, environment rule, safety policy, and final gate. Ask for user input only when delivery needs a material product decision, missing credentials or authority, an irreversibly destructive action outside task scope, or resolution of a release failure that cannot be handled safely and autonomously.
• Prefer short-lived repository workload identities such as OIDC trusted publishing, GitHub Apps, and narrowly scoped machine identities. Do not add long-lived personal tokens, weaken two-factor authentication, or bypass provider controls to eliminate an interactive prompt. Batch unavoidable human-gated production promotions into intentional stable releases while agents publish validated prerelease or beta channels through workload identities when the repository supports them.
• Preserve useful reasoning fan-out, but avoid unnecessary checkout fan-out. Prefer subagents in the current task for bounded research, review, diagnosis, and focused checks when they can safely share one working tree; create a separate task or worktree only for independently deliverable divergent edits, an isolated verification tree, or a different execution environment.
• Give each expensive focused validation command and external wait one owner. The integration owner reviews that evidence and runs the repository-required aggregate or final gate once after convergence. Reuse evidence only for the exact Git tree, command, lockfiles, toolchain, relevant environment, and validity period, and never to skip a required final integration, merge, release, deployment, or production-verification gate.
• On Hraness development machines, use $hra-local-efficiency and the installed host scheduler for heavyweight top-level commands when available. Keep ordinary work in the compute lane; give authenticated browser/dev-server/Chromium work one browser-auth owner and Mac-only validation one mac-native owner.
• When a CI or policy gate scans complete Git history, check out the exact governed SHA and fetch only the fully qualified governed refs before scanning. Preserve the complete-history gate and reject unexpected refs instead of importing unrelated concurrent heads.
• At closeout, record applicable branch, PR, check, merge, release, deployment, and production evidence. Archive only conclusively finished tasks, never from silence alone, and reclaim only freshly revalidated clean merged worktrees through the guarded exact-path flow.