From c1699c02df05f72b26601dfcc706b5f461ea3099 Mon Sep 17 00:00:00 2001
From: Andrei <andrei@hasna.com>
Date: Thu, 23 Jul 2026 14:09:53 +0300
Subject: [PATCH 1/2] feat(rules): clarify coordinator task ownership

---
 src/global-agent-rules.ts | 16 ++++++++++----
 src/index.test.ts         | 45 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+), 4 deletions(-)

diff --git a/src/global-agent-rules.ts b/src/global-agent-rules.ts
index ace7770..465ec06 100644
--- a/src/global-agent-rules.ts
+++ b/src/global-agent-rules.ts
@@ -13,7 +13,7 @@ import type {
 
 export const globalAgentInstructionSourceSet = {
   id: "hasna-global-agent-rules-standard",
-  version: "2026-07-10",
+  version: "2026-07-23",
   title: "Hasna Global Coding Agent Rules Standard",
 } as const;
 
@@ -23,6 +23,8 @@ export const agentOperatingRulesSentinel = "<!-- hasna:agent-operating-rules v=1
 
 export const noBrittleHardcodingRule = "Do not hardcode brittle values, paths, provider names, config, business logic, environment-specific IDs, or one-off mappings when a source-of-truth, schema/config-driven, package-owned, reusable, or cleaner abstraction exists. This is especially strict in medium and large applications. Explicit constants, fixtures, tests, and temporary compatibility shims are allowed only when scoped, named, and justified." as const;
 
+const coordinatorConcurrencyRule = "While delegated or background workers run, coordinators advance every safe, ready, non-overlapping task and do not idle-watch or repeatedly poll workers. They check workers only when completion is signaled, the result becomes a dependency, or bounded intervention is needed. Preserve worker ownership and do not duplicate its assigned scope. If all remaining work is genuinely dependency-blocked, yield and resume on completion rather than manufacture work." as const;
+
 export const globalAgentInstructionProviders = ["generic", "antigravity", "codewith", "claude", "codex", "opencode"] as const;
 
 export type GlobalAgentInstructionProvider = (typeof globalAgentInstructionProviders)[number];
@@ -40,7 +42,7 @@ const sourceSetMetadata = {
 const provenance = {
   source: "open-identities:global-agent-rules",
   createdAt: "2026-07-01T00:00:00.000Z",
-  updatedAt: "2026-07-10T00:00:00.000Z",
+  updatedAt: "2026-07-23T00:00:00.000Z",
 } as const;
 
 const operatingRulesProvenance = {
@@ -155,6 +157,12 @@ export const globalAgentInstructionSourceInputs: InstructionSourceInput[] = [
       "",
       "Coordinator sessions route implementation through subagents and task workflows. A coordinator may inspect, plan, review, and record evidence, but it must not write product code directly unless the task explicitly assigns implementation to that session.",
       "",
+      coordinatorConcurrencyRule,
+      "",
+      "For materially multi-step work, the owning coordinator creates or reuses one runtime-native root and links it to the one authoritative Todos root. Recovery reuses both stable identifiers.",
+      "",
+      "Delegated workers inherit explicit scope and lineage only. They do not create competing root plans or duplicate Todos tasks unless explicitly assigned orchestration ownership.",
+      "",
       "Act autonomously: when a dispatch, package, CLI, or automation path fails, diagnose and repair the owning package or workflow before asking the user. Ask only when blocked by destructive actions, secret-bearing choices, or genuinely user-only decisions. Do not fall back to tmux prompt paste unless a human explicitly authorizes that emergency path.",
       "",
       "Apply a minimum adversarial verification policy: non-trivial code, config, release, or operational changes require an independent adversarial review or a clearly labeled adversarial self-review when no reviewer can be spawned. Reconcile findings before marking work complete.",
@@ -194,7 +202,7 @@ export const globalAgentInstructionSourceInputs: InstructionSourceInput[] = [
       "7. Never push directly to main, default, or protected branches unless the user explicitly instructs that exact repo and exact operation.",
       `8. ${noBrittleHardcodingRule}`,
       "9. Act autonomously: diagnose and repair owning CLIs, packages, and workflows before asking the user; ask only for destructive, secret-bearing, or user-only decisions.",
-      "10. Coordinator sessions do not write product code directly. They delegate implementation through subagents or task workflows and then inspect, review, and coordinate the result.",
+      `10. Coordinator sessions do not write product code directly. They delegate implementation through subagents or task workflows and then inspect, review, and coordinate the result. ${coordinatorConcurrencyRule}`,
       "11. Codewith native loops are Codewith-native scheduled or recurring sessions, including /loop and built-in loop tools. OpenLoops is a separate orchestration package and daemon. Use the correct term and mechanism.",
       "12. Dispatch failure requires self-healing. Do not use tmux prompt paste as a fallback unless explicitly authorized. Fix the owning package or route, publish or prepare the update, update affected machines, and record evidence.",
       "13. Minimum adversarial verification is required for non-trivial changes. Use a fresh adversarial reviewer when available; otherwise perform and label an adversarial self-review, then reconcile findings.",
@@ -355,7 +363,7 @@ export const globalAgentInstructionSourceInputs: InstructionSourceInput[] = [
     content: lines([
       "# Codewith Provider Overlay",
       "",
-      "Use native Codewith goal plans for substantial multi-phase work and native Codewith goals for coherent single-slice work. Keep short-horizon checklists aligned with the active native goal.",
+      "For materially multi-step owner work, create or reuse exactly one native Codewith goal plan and link it to the one authoritative Todos root; simple one-step answers and lookups are exempt. Coherent single-slice work may use one native goal. Recovery reuses the stable goal-plan and Todos identifiers.",
       "When creating or updating a native Codewith goal plan, add explicit adversarial verification goal nodes or steps during the plan and a final adversarial verification step before marking the plan complete.",
       "",
       "Use Codewith native /loop and built-in schedule or loop tools when the user asks for Codewith recurring work. OpenLoops is a separate package; do not call native Codewith loops OpenLoops.",
diff --git a/src/index.test.ts b/src/index.test.ts
index 80a7ab3..b16530e 100644
--- a/src/index.test.ts
+++ b/src/index.test.ts
@@ -977,6 +977,51 @@ describe("open-identities", () => {
     expect(configsExport.sources[3]).toMatchObject({ layer: "tool", merge: "append", order: 200 });
   });
 
+  test("Codewith export links materially multi-step work to stable native and Todos roots", () => {
+    const policy = createGlobalAgentInstructionSourceExport({ providers: ["codewith"] })
+      .sources
+      .map((source) => source.content ?? "")
+      .join("\n");
+
+    expect(policy).toContain("the owning coordinator creates or reuses one runtime-native root and links it to the one authoritative Todos root");
+    expect(policy).toContain("Recovery reuses both stable identifiers");
+    expect(policy).toContain("Delegated workers inherit explicit scope and lineage only");
+    expect(policy).toContain("They do not create competing root plans or duplicate Todos tasks unless explicitly assigned orchestration ownership");
+  });
+
+  test("exports coordinator non-idling semantics in canonical and non-overridable policy", () => {
+    const exported = createGlobalAgentInstructionSourceExport({ providers: ["codewith"] });
+    const canonical = exported.sources.find((source) => source.id === "hasna-global-coding-agent-system-prompt");
+    const nonOverridable = exported.sources.find((source) => source.id === "hasna-global-coding-agent-non-overridable-rules");
+
+    for (const source of [canonical, nonOverridable]) {
+      expect(source?.content).toContain("coordinators advance every safe, ready, non-overlapping task");
+      expect(source?.content).toContain("do not idle-watch or repeatedly poll workers");
+      expect(source?.content).toContain("They check workers only when completion is signaled, the result becomes a dependency, or bounded intervention is needed");
+      expect(source?.content).toContain("Preserve worker ownership and do not duplicate its assigned scope");
+      expect(source?.content).toContain("If all remaining work is genuinely dependency-blocked, yield and resume on completion rather than manufacture work");
+    }
+    expect(nonOverridable?.content).toContain("10. Coordinator sessions do not write product code directly");
+  });
+
+  test("Codewith overlay creates or reuses one native plan while preserving existing behavior", () => {
+    const codewithSources = listGlobalAgentInstructionSources({ providers: ["codewith"] });
+    const overlay = codewithSources.find((source) => source.id === "hasna-codewith-global-agent-overlay");
+
+    expect(overlay?.content).toContain("create or reuse exactly one native Codewith goal plan");
+    expect(overlay?.content).toContain("simple one-step answers and lookups are exempt");
+    expect(overlay?.content).toContain("Coherent single-slice work may use one native goal");
+    expect(overlay?.content).toContain("Recovery reuses the stable goal-plan and Todos identifiers");
+    expect(overlay?.content).toContain("add explicit adversarial verification goal nodes or steps");
+    expect(overlay?.content).toContain("Codewith native /loop");
+    expect(overlay?.ruleIds).toEqual([
+      "provider:codewith:native-goals",
+      "provider:codewith:goal-plan-adversarial-steps",
+      "provider:codewith:native-loops",
+      "provider:codewith:no-tmux-fallback",
+    ]);
+  });
+
   test("CLI exposes instruction source list, paths, show, set, validate, export, import, and sources", async () => {
     const dir = await mkdtemp(join(tmpdir(), "open-identities-instructions-cli-"));
     const storePath = join(dir, "identities.json");

From 6f02373f75d35f3a6be4c286f789d3a924432916 Mon Sep 17 00:00:00 2001
From: Andrei <andrei@hasna.com>
Date: Thu, 23 Jul 2026 14:24:08 +0300
Subject: [PATCH 2/2] fix(rules): capability-gate canonical execution roots

---
 src/global-agent-rules.ts |  2 +-
 src/index.test.ts         | 50 ++++++++++++++++++++++++++++-----------
 2 files changed, 37 insertions(+), 15 deletions(-)

diff --git a/src/global-agent-rules.ts b/src/global-agent-rules.ts
index 465ec06..f1fa878 100644
--- a/src/global-agent-rules.ts
+++ b/src/global-agent-rules.ts
@@ -159,7 +159,7 @@ export const globalAgentInstructionSourceInputs: InstructionSourceInput[] = [
       "",
       coordinatorConcurrencyRule,
       "",
-      "For materially multi-step work, the owning coordinator creates or reuses one runtime-native root and links it to the one authoritative Todos root. Recovery reuses both stable identifiers.",
+      "For materially multi-step work, the owning coordinator creates or reuses one durable execution root supported by the active runtime and links it to the one authoritative Todos root. A runtime without such a native primitive must not invent one; Todos remains authoritative. Recovery reuses stable identifiers.",
       "",
       "Delegated workers inherit explicit scope and lineage only. They do not create competing root plans or duplicate Todos tasks unless explicitly assigned orchestration ownership.",
       "",
diff --git a/src/index.test.ts b/src/index.test.ts
index b16530e..6f3f4c7 100644
--- a/src/index.test.ts
+++ b/src/index.test.ts
@@ -977,16 +977,19 @@ describe("open-identities", () => {
     expect(configsExport.sources[3]).toMatchObject({ layer: "tool", merge: "append", order: 200 });
   });
 
-  test("Codewith export links materially multi-step work to stable native and Todos roots", () => {
-    const policy = createGlobalAgentInstructionSourceExport({ providers: ["codewith"] })
-      .sources
-      .map((source) => source.content ?? "")
-      .join("\n");
-
-    expect(policy).toContain("the owning coordinator creates or reuses one runtime-native root and links it to the one authoritative Todos root");
-    expect(policy).toContain("Recovery reuses both stable identifiers");
-    expect(policy).toContain("Delegated workers inherit explicit scope and lineage only");
-    expect(policy).toContain("They do not create competing root plans or duplicate Todos tasks unless explicitly assigned orchestration ownership");
+  test("canonical policy capability-gates durable roots without provider mechanics", () => {
+    const exported = createGlobalAgentInstructionSourceExport({ providers: ["generic"] });
+    const canonical = exported.sources.find((source) => source.id === "hasna-global-coding-agent-system-prompt");
+
+    expect(canonical?.content).toContain("the owning coordinator creates or reuses one durable execution root supported by the active runtime");
+    expect(canonical?.content).toContain("links it to the one authoritative Todos root");
+    expect(canonical?.content).toContain("A runtime without such a native primitive must not invent one; Todos remains authoritative");
+    expect(canonical?.content).toContain("Recovery reuses stable identifiers");
+    expect(canonical?.content).not.toContain("runtime-native root");
+    expect(canonical?.content).not.toContain("native Codewith goal plan");
+    expect(canonical?.content).not.toContain("Codewith");
+    expect(canonical?.content).toContain("Delegated workers inherit explicit scope and lineage only");
+    expect(canonical?.content).toContain("They do not create competing root plans or duplicate Todos tasks unless explicitly assigned orchestration ownership");
   });
 
   test("exports coordinator non-idling semantics in canonical and non-overridable policy", () => {
@@ -1004,16 +1007,35 @@ describe("open-identities", () => {
     expect(nonOverridable?.content).toContain("10. Coordinator sessions do not write product code directly");
   });
 
-  test("Codewith overlay creates or reuses one native plan while preserving existing behavior", () => {
-    const codewithSources = listGlobalAgentInstructionSources({ providers: ["codewith"] });
-    const overlay = codewithSources.find((source) => source.id === "hasna-codewith-global-agent-overlay");
+  test("non-Codewith provider export excludes the native Codewith plan requirement", () => {
+    const exported = createGlobalAgentInstructionSourceExport({ providers: ["claude"] });
+    const policy = exported.sources.map((source) => source.content ?? "").join("\n");
+
+    expect(exported.sources.some((source) => source.id === "hasna-claude-global-agent-overlay")).toBe(true);
+    expect(exported.sources.some((source) => source.id === "hasna-codewith-global-agent-overlay")).toBe(false);
+    expect(policy).not.toContain("create or reuse exactly one native Codewith goal plan");
+  });
+
+  test("Codewith export contains exactly one native plan overlay and preserves policy boundaries", () => {
+    const exported = createGlobalAgentInstructionSourceExport({ providers: ["codewith"] });
+    const overlays = exported.sources.filter((source) => source.id === "hasna-codewith-global-agent-overlay");
+    const overlay = overlays[0];
+    const policy = exported.sources.map((source) => source.content ?? "").join("\n");
 
-    expect(overlay?.content).toContain("create or reuse exactly one native Codewith goal plan");
+    expect(overlays).toHaveLength(1);
+    expect(overlay?.content).toContain("For materially multi-step owner work, create or reuse exactly one native Codewith goal plan and link it to the one authoritative Todos root");
     expect(overlay?.content).toContain("simple one-step answers and lookups are exempt");
     expect(overlay?.content).toContain("Coherent single-slice work may use one native goal");
     expect(overlay?.content).toContain("Recovery reuses the stable goal-plan and Todos identifiers");
     expect(overlay?.content).toContain("add explicit adversarial verification goal nodes or steps");
     expect(overlay?.content).toContain("Codewith native /loop");
+    expect(policy).toContain("Do not set Codewith goal, token, or goal-plan budgets unless the user explicitly asks for budgets");
+    expect(exported.sources.map((source) => source.id)).toEqual([
+      "hasna-global-coding-agent-non-overridable-rules",
+      "hasna-global-coding-agent-system-prompt",
+      "hasna-agent-operating-rules",
+      "hasna-codewith-global-agent-overlay",
+    ]);
     expect(overlay?.ruleIds).toEqual([
       "provider:codewith:native-goals",
       "provider:codewith:goal-plan-adversarial-steps",