Your AGENTS.md
CHAIN INTACT
6STATEMENTS
3WOULD BIND
3STAY CONTEXT
DENYWrites stay in the workspace
Writes stay inside `src/`, `tests/` and `docs/`.AGENTS.md:6
{"capability":"fs:write","path":{"outside":["src/**","tests/**","docs/**"]}}
DENYSecrets are not readable
Never read `.env` or anything under `config/credentials/`.AGENTS.md:7
{"capability":"fs:read","path":{"inside":[".env","config/credentials/**"]}}
DENYFetches stay on listed hosts
Only fetch from `build.acme.internal`.AGENTS.md:10
{"capability":"net:fetch","host":{"notIn":["build.acme.internal"]}}
3 statements stay context
- We prefer small, reviewable changes.
- Zero `any`. Use `unknown` + narrowing or discriminated unions.
- Prefer `type` over `interface`.