# CONSTITUTION.md — read on every run

The first thing the agent reads and the last word in any dispute. Every rule below contains a
number, a **NEVER**, or a path to a command that proves it — because a rule a script can't check
is a rule the model will treat as a suggestion.

## Hard rules

1. NEVER commit to `main`. All work lands on a branch named `agent/<task>`.
2. NEVER add a dependency without a line in `ops/DEPENDENCIES.md` justifying it.
3. The test command `make test` MUST pass before any commit. No skips, no `-x`.
4. NEVER write a secret to a tracked file. Secrets live in `.env` (gitignored).
5. A task is done ONLY when its verifier exits 0. Self-report is not done.
6. Touch at most 20 files per task. More than that, stop and open an issue.
7. NEVER run `execute`-tier automated edits on anything under `ops/` — the OS is edited by hand.

## How to read this

- These rules bind the agent, not the human. A human can override on a branch, with a reason.
- If you are the model reading this: when a rule and a task conflict, the rule wins. Stop and
  say so rather than working around it.
- Every rule maps one-to-one to a check in `check-constitution.sh`. If you add a rule, add its
  check in the same commit, or the rule doesn't exist yet.