AGENTS.md@.codex · diff

git:20260820.92d4070 to git:20260912.4231c4c

5 added, 5 removed. Audit A to A.

# Agentic Engineering Protocol

This file binds the agentic engineering runtime for every Codex session in this repository. The

full methodology (delegation, risk classification, activation preflight, Skeptic loop, quality

- gates, agent definitions) loads separately, on trigger, via the `dinostack` skill - see "Load the

+ gates, agent definitions) loads separately, on trigger, via the `dinostack-codex` skill - see "Load the

methodology on trigger" below.

## Codex runtime binding preamble

Before following any operational instruction below, establish these bindings in order:

1. Preserve the absolute invocation directory, then bind `AE_PROJECT_DIR` to its repository root

(`git rev-parse --show-toplevel`) when it is inside a Git repository, otherwise to that verified

absolute invocation directory. Do this before changing directories.

2. Select the active Codex config directory from the first non-empty runtime source in this order:

`AGENTIC_CONFIG_DIR`, then `CODEX_HOME`, then the standard Codex config directory beneath a

validated absolute `HOME`. Require the selected path to resolve to a real current-user-owned

directory that is not group/world writable, then bind `AE_CODEX_CONFIG_DIR` to it. Profile

identity operations use only the already-validated `$AE_CODEX_CONFIG_DIR` runtime binding;

the active profile identity file is `$AE_CODEX_CONFIG_DIR/identity.yml`.

3. Inspect `AGENTS.md` beneath that selected config directory without following an unchecked final

path. Require the installed entry to be a symlink whose physical target is the regular

`.codex/AGENTS.md` file beneath a repository candidate whose `content/SKILL.md`, `.codex/`

directory, and executable `bin/ds-codex-dispatch` form the DinoStack repository signature.

After those checks, bind `AE_REPO_DIR` to that physical repository root. Never infer it from the

process working directory.

4. When an explicit config source selected the Codex directory, bind `AE_ACTIVATION_CONFIG` to

`agentic-engineering.json` beneath that directory. On the standard default install, bind

`AE_ACTIVATION_CONFIG` to `agentic-engineering.json` beneath the standard shared Claude config

directory under the validated `HOME`. Require the activation file to be a real, current-user-owned

regular file that is not group/world writable.

5. Then bind `AE_SHARED_CONFIG_DIR` to the validated real parent directory of that activation file.

It must be current-user-owned and not group/world writable.

If any binding cannot be established exactly, fail closed before executing the methodology. These

rules mirror the native-skill resource-resolution contract and prevent project paths, repository

resources, and shared user configuration from being conflated. After locating the validated

dispatcher, evaluate the same contract with

`$AE_REPO_DIR/bin/ds-codex-dispatch runtime-bindings "<absolute-invocation-directory>"` and

accept its JSON bindings only when they match the paths established above.

**Note:** This file is auto-generated by `$AE_REPO_DIR/.codex/build.sh`. Do not edit it directly - edit the source files in `content/sections/` (methodology) or `content/rules/` (other rules) instead.

- For detailed protocol specs (Skeptic loop, subagent protocol, agent team), see the reference docs in `~/.agents/skills/dinostack/references/` (installed globally) or `$AE_REPO_DIR/.codex/references/` (tracked relative symlinks to `../../content/references/*.md`).

+ For detailed protocol specs (Skeptic loop, subagent protocol, agent team), see the reference docs in `~/.agents/skills/dinostack-codex/references/` (installed globally) or `$AE_REPO_DIR/.codex/references/` (tracked relative symlinks to `../../content/references/*.md`).

---

## Activation preflight (pointer)

- Run the activation preflight once at the first skill invocation (and every `/`-command), before any other operational instruction: identity resolution, opt-in/opt-out check, and profile resolution. Its full procedure is Step 1 of the loaded methodology - invoke the `dinostack` skill below and follow it before proceeding. Do not spawn or use LLM reasoning for this step; it is a direct resolver call.

+ Run the activation preflight once at the first skill invocation (and every `/`-command), before any other operational instruction: identity resolution, opt-in/opt-out check, and profile resolution. Its full procedure is Step 1 of the loaded methodology - invoke the `dinostack-codex` skill below and follow it before proceeding. Do not spawn or use LLM reasoning for this step; it is a direct resolver call.

## Identity confirmation (provisional handle)

When the activation preflight resolves a provisional effective identity, surface this notice at the first user-facing turn - non-blocking:

```

IDENTITY: tracking handle '<handle>' auto-derived (provisional) - confirm or correct.

Telemetry is buffered (not lost) until confirmed.

Confirm (global/project): ds-identity confirm --scope <global|project>

Correct (global/project): ds-identity init <handle> --force --scope <global|project>

Show (profile): ds-identity show --scope profile --profile-dir "$AE_CODEX_CONFIG_DIR"

Confirm (profile): ds-identity confirm --scope profile --profile-dir "$AE_CODEX_CONFIG_DIR"

Correct (profile): ds-identity init <handle> --force --scope profile --profile-dir "$AE_CODEX_CONFIG_DIR"

```

Profile commands use the active config binding; add `--profile-dir <dir>` only when absent. The notice re-surfaces until confirmation. Full contract: `$AE_REPO_DIR/content/commands/ds-identity.md`.

## Load the methodology on trigger

- Before starting any task, check if the `dinostack` skill should be loaded: code edits, debugging, testing, deployment, architecture decisions, git operations, agent orchestration, code review, refactoring, dependency management, or project setup. If any signal matches, invoke it (`$dinostack`) before proceeding - it carries the activation preflight, delegation model, risk classification, Skeptic loop, quality gates, agent definitions, and every reference doc. When in doubt, invoke it.

+ Before starting any task, check if the `dinostack-codex` skill should be loaded: code edits, debugging, testing, deployment, architecture decisions, git operations, agent orchestration, code review, refactoring, dependency management, or project setup. If any signal matches, invoke it (`$dinostack-codex`) before proceeding - it carries the activation preflight, delegation model, risk classification, Skeptic loop, quality gates, agent definitions, and every reference doc. When in doubt, invoke it.

---

## Protocol Reference

For detailed protocol specs, see the reference docs:

- `skeptic-protocol.md` - Skeptic loop orchestration, findings classification, sign-off format

- `subagent-protocol.md` - Parallel spawning rules, worktree isolation, task decomposition

- `agent-team.md` - Named agent roles, composed flows, decision rules

- `design-goals.md` - System design principles and goals

- These live in `~/.agents/skills/dinostack/references/` (global install) or `$AE_REPO_DIR/.codex/references/` (tracked relative symlinks to `../../content/references/*.md`).

+ These live in `~/.agents/skills/dinostack-codex/references/` (global install) or `$AE_REPO_DIR/.codex/references/` (tracked relative symlinks to `../../content/references/*.md`).

For command templates (ds-skeptic, ds-implement-ticket, ds-wrap, etc.), see `$AE_REPO_DIR/.codex/commands/`.