AGENTS.md git:20260910.663464dA

Immutable. This exact content is served forever at /api/v1/blob/b82ea16b0e52bac9.

<!-- kb:context scopes/repository--cdb4ee2aea69 -->
# Contents

- `src/` – portable declarative and imperative workflow SDKs, host-resource admission, diagrams, direct Vercel AI Gateway generation, local vectorization, semantic operations, MCP, and canvas integration.
- `apps/desktop/` – the canonical `slopcamera` CLI, complete local media host, durable scheduler, HTML and Three.js overlays, native capture helpers, frontend, and desktop shell.
- `apps/web/` – the static `slopcamera.com` site, with a local browser bundle and a production-only anonymous pageview boundary but no API, account, or credential surface.
- `packages/scene/` – the shared local scene-analysis contract.
- `src/code/` – portable declarative graph authoring, the closed public capability projection, compilation, planning, and execution contracts.
- `src/spatial-scene/` – portable editable scene contracts, stable identity, semantic patches, calibrated evaluation, and bounded GLB parsing.
- `src/studio/` – portable retained native production jobs, runtime evidence, output semantics, admission plans and receipts.
- `schema/` – version-one diagram JSON Schema.
- `skills/slopcamera/` – the canonical Slopcamera Agent Skill.
- `.agents/skills/` – portable repository orchestration and knowledge-base workflows.
- `kb/` – the Git-backed Markdown vault for rationale, evidence, maintained synthesis, plans, and scoped agent context.
- `examples/` – checked diagram, configuration, and executable imperative and declarative Bun workflow examples.
- `scripts/` – schema, skill, package, release, and official-vectorizer verification.
- `dist/` and `apps/desktop/dist/cli/` – committed Bun-targeted entrypoints consumed by package and Git installs.
- `.github/workflows/` – routed SDK, local-host, static-site, macOS-native, official VTracer, and immutable release checks.
- `docs/` – the documentation entry point, first-result tutorials, creative task guides, capability and SDK reference, architecture explanations, and provider/release runbooks.
- `README.md`, `CONTRIBUTING.md`, `SECURITY.md`, `LICENSE`, and `NOTICE.md` – public documentation, policy, and terms.
- `WRITING.md` and `STYLE.md` – internal and public prose contracts.
- `package.json`, `tsconfig.json`, and `bun.lock` – standalone package and verification configuration.

# Guidelines

- Use Bun 1.3.14 and complete the source gate in `CONTRIBUTING.md`: focused local checks and independent impact review, then fresh complete CI on the exact current integration candidate, or the local `bun run check` fallback. Preserve every explicit local, native, browser, installation, live, release and npm-mirror gate.
- Follow `WRITING.md` for internal prose and `STYLE.md` for public prose, preserving facts, exact terms, literals, quotations, links, and necessary uncertainty.
- Follow the shared [README guidelines](https://github.com/hraness/.github/blob/main/README_GUIDELINES.md) for the root README and any site copy that summarizes it.
- Apply the shared [documentation guidelines](https://github.com/hraness/.github/blob/main/DOCUMENTATION_GUIDELINES.md) to every maintained documentation surface. Use Diátaxis to distinguish guided learning, task completion, factual reference and explanation; make each page's reader need clear without imposing four folders. Keep marketing, README, docs, CLI/SDK help and agent skills consistent with actual release, interface, platform and trust boundaries. Preserve historical sources and all local validation gates.
- Apply unreasonably robust programming when agent work is cheap. Prefer coherent cross-file correctness and focused deterministic evidence while treating production risk, provider coordination, rollout, and observation as real costs.
- Deliver changes to `main` through a current-head pull request. Keep the stable `Required` CI job green, resolve every review thread, and serialize merges. Human approval stays optional while one regular maintainer would otherwise self-review. Never force-push or bypass the gate.
- Keep this repository independently buildable. Never depend on sibling paths, Git submodules, or coordinated `main` branches; consume external Hraness packages only through reviewed immutable release tags or commits.
- Extract a shared package only after a second concrete consumer proves a stable product-neutral contract. Shared packages never import product code.
- Keep Slopcamera's product and editor presentation local. Add `@hraness/ui` for portable accessible primitives or `@hraness/design-kit` for optional shared presentation only after concrete reuse warrants the dependency; domain layout and content remain Slopcamera-owned.
- Freeze shared interfaces before parallel lanes begin. Give one integration owner manifests, lockfiles, generated registries, and other convergence files, then let consumers upgrade immutable releases independently.
- Keep mandatory edit-time rules in the closest `AGENTS.md`, current procedures in `docs/`, executable contracts in types, schemas, and tests, and rationale, evidence, synthesis, and plans in `kb/`. KB lanes run `bun run kb:check:lane`; the integrator performs one refresh and `bun run kb:check`.
- Keep `@hraness/slopcamera` at the repository root. The root package owns both the portable SDK and canonical `slopcamera` binary built from `apps/desktop/cli/main.ts`.
- Keep canonical commands namespaced as `slopcamera diagram init|check|render`, `slopcamera image generate|vectorize`, and the `code`, `mcp`, `canvas`, `skill`, and `doctor` surfaces.
- Keep local vectorization authentication-free and network-silent. Gateway generation reads `AI_GATEWAY_API_KEY` before `VERCEL_OIDC_TOKEN`, never persists credentials, pins the Gateway origin, bounds responses, and sets `maxRetries: 0`.
- Keep `/artifacts/`, `.env`, and `.env.*` ignored. Recordings, imported media, private project metadata, Gateway tokens, and provider options must never enter Git or a package artifact.
- Treat `vercel env run -- <command>` as the ergonomic local Vercel path. Never shell out to infer or scrape a token from the Vercel CLI.
- Treat Production as Slopcamera's only durable Vercel environment. Do not create a custom environment, persistent Preview domain, or provider-authoritative Preview branch. Pull requests may use Vercel's built-in disposable Preview target, without production-only variables or another durable backend. Follow [the Vercel runbook](docs/vercel.md) and audit provider identity before changing this seam.
- Preserve `.diagram.json` version one and the five same-stem render outputs: `.tldr`, light and dark SVG, and light and dark PNG.
- Keep one self-contained Slopcamera identity. Public APIs, serialized identifiers, source imports, configuration, and runtime surfaces use only Slopcamera names.
- Preserve every immutable version-1 tag and Release. Never rewrite a historical tag or recreate a repository at the former GitHub path, because doing so would replace GitHub's compatibility redirect.
- Treat diagram source as authoritative and generated media as replaceable. Defaults may resolve mechanics but must not invent claims, labels, legends, relationships, or decorative meaning.
- Model invalid states out, parse foreign values from `unknown`, and keep output deterministic. Preserve readable regression examples; add property tests for laws, parsers, reducers, ordering, and round trips, and promote shrunk failures into named deterministic examples.
- Keep semantic registries fixed and typed. Never accept source text, evaluation, dynamic imports, executable workspace configuration, shell commands, or caller-selected remote URLs.
- The fixed `slopcamera.studio.run` operation is an explicit native-authoring exception: it may execute a previously retained, hash-bound Python or native-scene bundle through a closed Blender/Manim/CadQuery host adapter. It requires a separate invocation-scoped trusted-current-user envelope; source import, pure planning and inspection stay inert. Runtime paths and argv remain host-owned, and the profile declares no OS sandbox or hermetic dependency closure.
- Preserve the root module and `./workflow` v0.8 imperative APIs. Add declarative graphs through `./code` and lower-level compiler contracts through `./code/advanced`; do not add `./code/testing` or `./code/workflows` exports.
- Treat explicitly imported workflow modules as trusted current-user Bun code. Compile graphs only against the host's closed capability projection, reject an unsupported capability before executor or resource admission, and do not add an open operation-registration hook.
- Treat the portable SDK and core as the canonical graph contract. The complete local host consumes that contract through its own closed projection and owns durable media execution. The Desktop shell adds only native capture, permissions, and UI.
- Model one project as immutable source plus explicit revisions, candidates, selections, and delivery variants. Keep ready work bounded by resource claims and serialize expensive encodes by default.
- Keep imperative workflows as explicitly imported trusted Bun modules over the fixed operation registry. Parse runtime input, bound and uniquely identify steps, drain dispatched work before returning, retain completed-step receipts on every failure path, and do not load caller-selected source paths.
- Keep semantic SDK, CLI, MCP, and workflow resource admission machine-global and crash-safe on macOS and Linux, with a truthful process-local fallback elsewhere. Preserve profile identity, FIFO admission for overlapping claims, callback-settlement ownership, and inherited lease descriptors through spawned vectorizer processes.
- Keep MCP paths root-relative and capability-small. Bound source bytes, arrays, shapes, edges, scale, pixels, findings, subprocess duration, and output bytes before execution.
- Keep vectorization fail-closed with checksum-pinned VTracer archives, inert rebuilt SVG, measured fidelity, and full provenance receipts. Do not add an embedded-raster fallback, upscaling model, or bundled commercial font.
- GitHub Releases are canonical. Follow `docs/publishing.md`; preserve every historical npm version, tag and Release. The new `@hraness/slopcamera` source package has no `contentPolicy` declaration. Keep factual data-handling guidance in `PRIVACY.md` and preserve actual capture, consent and credential controls. npm is an optional downstream mirror, and a publisher for the historical package does not authorize this new package.
- Use the two exact active `refs/tags/v*` rulesets: **Immutable version tags** restricts update/deletion with no bypass; **Release tag creation** restricts creation with owner `User` ID `894119` as the sole bypass actor. From clean current `main`, use `scripts/push-release-tag.ts`; preserve exact owner/repository/protected-main/CI attempt/Required job, stable ordering and conditional annotated-tag identity. Never grant another actor tag bypass, create probe tags, move a tag or recreate a historical release.
- Build one canonical archive from the protected tagged source after the full gate; retain isolated package installation, all five official VTracer targets and macOS shell tests/package. Bind the five documented assets to exact source, workflow, current-main helper closure and hosted run/attempt provenance. Attestation and publication jobs must check out no product source, run no package code, and independently reauthorize the complete handoff before credentials or mutation. Publish through a verified draft and require immutable Latest readback. Never overwrite assets or relabel a previous attempt's provenance; reconcile matching state and stop on mismatch or uncertain authority.
- Keep optional `npm-stage.yml` dispatch-only and bound to current-main owner actor/triggering actor, repository/workflow/run/attempt and the exact `npm-stage` environment. Preserve selected-main-only policy, disabled administrator bypass, no required reviewers/secrets, OIDC stage-only authority, empty npm configurations, no traditional token, no explicit dist-tag, canonical packed configuration, bounded independent USTAR readers and every retained version-bound mutation-intent guard. Mirror only the exact already-published and cryptographically verified GitHub archive. Keep the full source gate on the canonical artifact source and admit its archive with current-main smoke and policy helpers. Recheck the current workflow source, annotated canonical source, immutable release digests and npm monotonic latest immediately before staging. Resolve ambiguous provider writes before clearing their exact intent; public npm promotion still requires interactive two-factor authentication and does not block GitHub delivery.

<!-- hra-local-efficiency:start -->
- Treat the user's request to change this repository as standing authorization for routine task-owned commits, pushes, pull requests, merges, releases, deployments, and production verification after the gates applicable to that action pass. Do not ask for duplicate confirmation. Build confidence through relevant automated checks, bounded diagnostics, and independent review, not another human approval. Passing checks does not expand task scope or authority.
- Prefer agentic service provisioning for new infrastructure. Check Vercel Marketplace for a native product that can provision the required resource first; use Stripe Projects as a supported alternative when it better covers the service or the Marketplace route only connects an existing account. Verify the current catalog, account, region, plan, recurring cost and resource capabilities before selecting a route. Prefer supported provider CLIs or APIs over browser-only setup when neither catalog fits, and explain the concrete exception. Reuse existing owner-controlled resources where appropriate; this preference alone does not authorize migrations, duplicate accounts, paid upgrades or wider access. Continue setup already authorized by the task and budget without duplicate confirmation. Keep provider credentials and generated environment files private, complete required interactive authentication, and verify deployment, persistence and recovery separately from successful provisioning.
- Separate artifact admission from live qualification and operational activation. Use applicable automated source, security, package/install, and provenance evidence for artifact admission; live provider qualification is not a universal publication prerequisite. Preserve explicit live acceptance criteria and require relevant live evidence for claims that depend on it. If publication or an artifact's install, upgrade, or default-use path activates risky unqualified behavior, keep that behavior guarded or disabled, or obtain bounded relevant evidence before shipping or activation.
- Use the repository's documented delivery workflow and preserve the identity, target, capacity, migration, and recovery guards applicable to operational activation. Replace an obsolete gate through a reviewed source and policy change with corresponding tests, never an ad hoc skip. Preserve every runtime-enforced approval, access control, branch protection, environment rule, safety policy, and required final gate. Ask for user input only when delivery needs a material product decision, missing credentials or authority, unavoidable interactive authentication, an irreversibly destructive action outside task scope, or resolution of a failure that cannot be handled safely and autonomously.
- Preserve production and user data throughout delivery. Inspect the exact account, environment, deployment, and data target before writes. For data changes, inspect a dry run or equivalent migration plan and validate the recovery path before any effect that could lose or corrupt data. Prefer additive, backward-compatible migrations and bounded batches. Record mutation intent, use idempotency or conditional writes, and reconcile uncertain results before retrying. Verify deployed identity, health, and relevant data invariants after delivery. Routine delivery never authorizes resetting, truncating, dropping, or overwriting user data; stop the unsafe operation if preservation or recovery cannot be established.
- Prefer short-lived repository workload identities such as OIDC trusted publishing, GitHub Apps, and narrowly scoped machine identities. Use unattended stable publication and production promotion when supported by the provider and repository. Establish supported machine authority once and verify it with a non-publishing preflight where available; routine releases should not require recurring interactive authentication or conversational approval. Retain account two-factor authentication and provider controls, including required authentication for approval of an exact staged artifact; do not add long-lived personal tokens to eliminate an interactive prompt.
- Keep delivery gates proportional to the failure they prevent. Prefer required checks on the current integration candidate, independent agent review, and atomic or conditional integration. Add a merge queue or another approval stage only for a demonstrated coordination or safety need. Replace redundant queues, serial waits, and duplicate checks through reviewed policy changes while retaining evidence for the integrated result.
- Preserve useful reasoning fan-out, but avoid unnecessary checkout fan-out. Prefer subagents in the current task for bounded research, review, diagnosis, and focused checks when they can safely share one working tree; create a separate task or worktree only for independently deliverable divergent edits, an isolated verification tree, or a different execution environment.
- Give each expensive focused validation command and external wait one owner. The integration owner reviews that evidence and runs the repository-required aggregate or final gate once after convergence. Reuse evidence only for the exact Git tree, command, lockfiles, toolchain, relevant environment, and validity period, and never to skip a required final integration, merge, release, deployment, or production-verification gate.
- On Hraness development machines, use `$hra-local-efficiency` and the installed host scheduler for heavyweight top-level commands when available. Keep ordinary work in the compute lane; give authenticated browser/dev-server/Chromium work one `browser-auth` owner and Mac-only validation one `mac-native` owner.
- When a CI or policy gate scans complete Git history, check out the exact governed SHA and fetch only the fully qualified governed refs before scanning. Preserve the complete-history gate and reject unexpected refs instead of importing unrelated concurrent heads.
- At closeout, record applicable branch, PR, check, merge, release, deployment, and production evidence. Archive only conclusively finished tasks, never from silence alone, and reclaim only freshly revalidated clean merged worktrees through the guarded exact-path flow.
<!-- hra-local-efficiency:end -->