AGENTS.md@.github/actions/run-tracked-guards git:20261028.b7cb304A

Immutable. This exact content never changes and is served at /api/v1/blob/a1bac04c5af474bd.

# `run-tracked-guards` — agent notes

Single source of the tracked-tree guards. See [README.md](README.md) for the
command table.

## Contract

- Exactly three commands, in order: `check_tracked_all.py`,
  `check_tracked_secrets.py`, `check_tracked_generated_artifacts.py`. Both
  workflows rely on this set; a fourth check that only one lane needs stays in
  that lane.
- The guards stay sequential and blocking. Do not background them into the
  `run-public-lint` wave: their failures name the offending paths and must not
  interleave.
- `set -euo pipefail` stays explicit so a missing script is a failure, not a
  silent pass.

## Editing

- Run `actionlint` after edits, keep [README.md](README.md) accurate, and verify
  both callers still resolve the action after checkout.