Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Create a practical agent-ready operating model for a repository. Requirements: (1) author concise project instructions covering architecture, commands, validation, secrets, migration or deploy boundaries, and human approval points; (2) audit the instructions for ambiguity, stale details, and unsafe permission broadening; (3) design a read-only review or quality automation hook with explicit trigger, inputs, allowed actions, output, failure behavior, owner, and tests; (4) build a machine-readable non-interactive analysis artifact such as a changed-file summary, CI-failure summary, or diff-risk report; (5) isolate all logs and pull-request text as untrusted data; (6) add tests or fixtures for the automation output schema and one malicious or malformed input; (7) provide a short governance note explaining routine versus elevated agent actions.
Instructions are concise, actionable, consistent with the repository, and cover critical boundaries such as validation, secrets, tests, migrations, deployment, and approval ownership.
The hook or CI artifact has narrow read-only authority, typed output, trustworthy failure handling, untrusted-input isolation, clear logs, and fixtures that prove expected behavior.
The project defines reviewable diffs, routine versus elevated actions, owners, escalation, and a credible explanation of why automation does not make high-impact decisions autonomously.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A repository operating guide and review automation ## Goal Create a practical agent-ready operating model for a repository. Requirements: (1) author concise project instructions covering architecture, commands, validation, secrets, migration or deploy boundaries, and human approval points; (2) audit the instructions for ambiguity, stale details, and unsafe permission broadening; (3) design a read-only review or quality automation hook with explicit trigger, inputs, allowed actions, output, failure behavior, owner, and tests; (4) build a machine-readable non-interactive analysis artifact such as a changed-file summary, CI-failure summary, or diff-risk report; (5) isolate all logs and pull-request text as untrusted data; (6) add tests or fixtures for the automation output schema and one malicious or malformed input; (7) provide a short governance note explaining routine versus elevated agent actions. ## Acceptance criteria - [ ] Durable repository guidance: Instructions are concise, actionable, consistent with the repository, and cover critical boundaries such as validation, secrets, tests, migrations, deployment, and approval ownership. - [ ] Safe automation design: The hook or CI artifact has narrow read-only authority, typed output, trustworthy failure handling, untrusted-input isolation, clear logs, and fixtures that prove expected behavior. - [ ] Review and governance quality: The project defines reviewable diffs, routine versus elevated actions, owners, escalation, and a credible explanation of why automation does not make high-impact decisions autonomously. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.