AGENTS.md

1# internal — Agent Contract
2 
3## Scope
4 
5This subtree owns first-party Go packages for SDP runtime, CLI backends,
6orchestration, evidence, model routing, policy, dispatch, and evaluation.
7 
8## Contract
9 
10Package APIs must be readable, bounded, and testable. Stable package contracts
11belong in the nearest package-local `AGENTS.md` when a package has runtime,
12security, provider, evidence, or extraction assumptions.
13 
14## Dependencies
15 
16Prefer stdlib and existing internal substrate packages. New cross-package
17dependencies must improve UX or DX and must not create hidden coupling between
18lab-only, experimental, and stable release surfaces.
19 
20## Runtime Assumptions
21 
22Most packages run locally inside a git worktree. Network, provider credentials,
23filesystem writes, subprocess execution, or long-running background behavior must
24be explicit in the package-local contract or code comments near the boundary.
25 
26## Local Rules
27 
28- Read `docs/reference/go-patterns.md` before Go edits.
29- Preserve package boundaries from `docs/reference/product-surface.md` and
30  `docs/reference/maturity-matrix.md`.
31- Add or update package-local `AGENTS.md` for packages with non-obvious runtime
32  assumptions.
33- Do not use `context.Background()` in long-running or request-scoped paths when
34  a caller context is available.
35- Do not treat denylist-based subprocess filtering as a security boundary.
36