git:20261009.810ba09 to git:20261022.f58d663

---

description: Scope a change and land it without a multi-round review loop

globs: **/*

alwaysApply: true

---

# Change discipline

The canonical text is **`AGENTS.md` → "Working agreement", "Validation scope",

"Change discipline", and "Definition of Done"**. This file mirrors those rules

for Cursor; keep it in sync. If the guides disagree, AGENTS.md wins.

The short form:

1. **Complete authorized work through validation and self-review.** Resolve routine

choices from the code; ask about missing information that changes scope or behavior.

Plans, audits, and reviews stay read-only unless edits are requested.

2. **For user-facing features, write 3–5 acceptance criteria and explicit exclusions

before implementation.** Put them in the PR description before the first commit;

draft the description locally if there is no PR yet.

3. **Put a shared rule where every path reaches it, then delete the other copy** —

not at the site the report happened to mention.

4. **Search for sibling paths**, including live/cache and statusline/hook readers.

5. **Make a new regression test fail before trusting it.** For call-site bugs,

remove the call and confirm red; restore it afterward and preserve unrelated edits.

6. **Never assert wall-clock time.** Assert the observable consequence instead.

7. **Use AGENTS.md's validation scope and read the output.** Prose-only edits need

`git diff --check`, link/contract checks, and the `node --input-type=module` block in

[AGENTS.md's private-document boundary check](../../AGENTS.md#private-document-boundary-check).

Code, dependency, and executable config

changes need build → typecheck → test → lint plus relevant CI smoke/pack checks.

`scripts/gate.sh` runs that list locally with one verdict per step (not `release:qa`,

pushed SHA); with `--commit <message-file>` it commits only when every step is ok, or, with

`--allow-offline-audit`, when the audit alone was skipped offline (the commit line says so

and the exit stays nonzero).

The `verify-claudinho` skill and `node scripts/verify.mjs` are the offline inner loop; the control

CLI replaces neither CI's jobs nor the live pass, `release:qa`.

User-facing behavior and releases also need `release:qa` after build. Rerun checks

for new changes, failures, or unresolved concerns; after a push, verify CI on that SHA.

8. **Start every task at the router skill**, `.claude/skills/claudinho-mode/SKILL.md`

(mirrored at `.cursor/skills/claudinho-mode/SKILL.md`), which names the playbook for the

task's kind, and find a failure class and the enforcer that refuses it in

**`AGENTS.md` → "Rules and their enforcers"**.