AGENTS.md git:20261105.3773c37A

Immutable. This exact content never changes and is served at /api/v1/blob/c774a3ffd1bd02ee.

# AGENTS.md

Guidance for AI agents (and humans) contributing to this repository. See
[CONTRIBUTING.md](CONTRIBUTING.md) and
[docs/branching-and-release.md](docs/branching-and-release.md) for the full
process.

See [docs/agents-spec.md](docs/agents-spec.md) for the canonical authoring and
projection model and [docs/hooks-strategy.md](docs/hooks-strategy.md) for the
standards-first adapter philosophy.

## Branch & PR rules

- `main` is the only integration branch. Start short-lived branches from current
  `origin/main`, and open reviewed PRs targeting `main`.
- Never push directly to `main`. Squash using a Conventional Commit title/body,
  preserving any breaking-change declaration.
- Publication is scheduled/manual only; see `docs/branching-and-release.md`.

## Commit messages

- Use [Conventional Commits](https://www.conventionalcommits.org/). The version
  bump, `CHANGELOG.md`, and GitHub Release notes are derived from them by
  `semantic-release`.
- Type → release notes section: `feat:` → **Added**, `fix:`/`revert:` →
  **Fixed**, `refactor:`/`perf:` → **Changed**. `chore:`/`test:`/`build:`/`ci:`/
  `style:` are hidden from the notes.
- Mark breaking changes with `!` or a `BREAKING CHANGE:` footer.

## Local checks before opening a PR

```bash
npm ci
npm run typecheck
npm run build
npm test
```

## Telemetry

- **OpenTelemetry (OTel)**: For every new feature or requirement added, ensure you implement corresponding OpenTelemetry instrumentation (spans, events, or metrics) to maintain observability.
- **OTel CLI Compliance**: All CLI programs and external subprocess wrappers must strictly follow the official [Semantic conventions for CLI programs](https://opentelemetry.io/docs/specs/semconv/cli/cli-spans/):
  - Use `SpanKind.INTERNAL` for the CLI's own execution (callee spans) and `SpanKind.CLIENT` for subprocess calls (caller spans).
  - Span names must default to `{process.executable.name}` (e.g. `"git"`, `"claude"`) or documented low-cardinality values.
  - Correctly record all **Required** attributes: `process.executable.name` and `process.exit.code`.
  - Record `process.pid` when available (Recommended).
  - Correctly record `error.type` on failure spans (when `process.exit.code !== 0`) as **Conditionally Required**.
  - Do NOT collect `process.executable.path` — it is always PII and provides no analytical value after sanitization.
- **Telemetry Privacy**: **All telemetry data must comply with privacy standards**—never log raw file paths, personally identifiable information (PII), or user secrets/tokens. Sanitization (e.g., `sanitizeArgs()`) is mandatory before collecting `process.command_args`.

## Do not

- Do not commit or publish private upstream source content as test fixtures,
  including compressed snapshots. Use synthetic public fixtures; keep checks
  against private releases local or in a private test environment. Verify
  upstream visibility and redistribution authorization before copying content.
- Do not stage, commit, push, or open PRs unless explicitly asked.
- Do not edit release/CI config (`.releaserc.json`, `.github/workflows/*`),
  lockfiles, or branch-protection scripts without surfacing the risk first.
- Do not bypass branch protection or enable publication without explicit authorization.