The controls for the rules no machine held

model/controls/a-chat-answer-s-claims-are-read-back-against-the-model.md

@@ -0,0 +1,29 @@
+---
+id: 01a13d68-db37-7f46-b1e4-64a481a608d3
+source: Local
+kind: detective
+mode: automated
+enforces:
+  - Nothing claims what the model does not hold
+---
+
+# A chat answer's claims are read back against the model
+
+> Each claim of an answer the chat gives on guestgraph.io is read back against the tool answers it rests on, and the chat marks one they do not carry before the visitor takes it for what the model says.
+
+## How it is carried out
+
+The chat server behind guestgraph.io, on every answer once it is written: it sends each claim, with the tool answers the chat's model was given, to TypeSafe's Jev, which returns a verdict and its probability and writes no text, and the widget marks a claim whose verdict is that the evidence does not carry it, above the threshold this deployment's configuration sets. Only an answer written in English is marked; a German one is checked and its verdicts kept until German has a threshold of its own. The check changes no word of the answer, and a check that cannot run, or does not finish within its budget, marks nothing. It holds the chat's answers and nothing else: a specification or a page someone writes is held to the rule by whoever writes it.
+
+## Applies to
+
+| Type | Entity | Owner |
+| --- | --- | --- |
+| phase | Answer | Answering |
+
+## References
+
+| What | URL |
+| --- | --- |
+| The claim check | https://github.com/companygraph/chat-server/blob/main/lib/verdict.mjs |
+| This deployment's configuration | https://github.com/guestgraph/mcp-guestgraph-io/blob/main/chat/chat.json |

model/controls/a-family-resync-refuses-to-start-beside-another.md

@@ -0,0 +1,28 @@
+---
+id: 01a13d68-db37-75d3-94ab-1955459a0828
+source: Local
+kind: preventive
+mode: automated
+enforces:
+  - One session holds a piece of shared work
+---
+
+# A family resync refuses to start beside another
+
+> A resync takes a lock before it moves anything, and refuses to start while another run holds it or while a resync pull request it did not open is still open.
+
+## How it is carried out
+
+The family resync in robertblust/conventions, each time a session starts it: it takes a lock in the clone's own git directory, which every worktree of that clone shares, and refuses while the run that holds it is alive; it then asks GitHub for the open pull requests of every member whose branch begins with `resync-`, and refuses where one is open that no run in this checkout opened or took on that day, unless it is started with `--force`. It holds a resync and nothing else: a release, a re-pin by hand or a change across repositories is claimed by the session itself, which reads the open pull requests, branches and tags and asks the running sessions before it starts, and nothing refuses a session that skips that.
+
+## Applies to
+
+| Type | Entity | Owner |
+| --- | --- | --- |
+| phase | Integrate | Delivery |
+
+## References
+
+| What | URL |
+| --- | --- |
+| The family resync | https://github.com/robertblust/conventions/blob/main/family/resync.mjs |

model/controls/a-guest-s-data-in-a-request-is-taken-out-of-it.md

@@ -0,0 +1,29 @@
+---
+id: 01a13d68-db37-70a7-a505-5713fdca4f22
+source: Local
+kind: detective
+mode: manual
+enforces:
+  - A feature request carries no guest's data
+performed-by: Owner
+---
+
+# A guest's data in a request is taken out of it
+
+> The Owner reads every feature request for a guest's data before restating it, and takes out any it finds, from the issue and from its edit history.
+
+## How it is carried out
+
+The Owner, in Understand, on every feature request: before restating it, it reads the request and every comment on it for a guest's data, a name, an address, a booking or anything else that points at a guest; where it finds any, it edits it out, deletes the content of that edit from the issue's edit history, which leaves only who edited and when, and asks for the gap again without it. It never asks for a guest's data to illustrate a request. An issue is public from the moment it is opened, so what was read before the Owner took it out stays read; the control shortens that time and cannot undo it.
+
+## Applies to
+
+| Type | Entity | Owner |
+| --- | --- | --- |
+| phase | Understand | Feature request |
+
+## References
+
+| What | URL |
+| --- | --- |
+| GitHub's edit history and how to delete from it | https://docs.github.com/en/communities/moderating-comments-and-conversations/tracking-changes-in-a-comment |

model/controls/a-message-from-another-session-carries-no-word-of-the-owner-s.md

@@ -0,0 +1,30 @@
+---
+id: 01a13d68-db37-786e-b64d-1fe60ac2adf0
+source: Local
+kind: preventive
+mode: automated
+enforces:
+  - A refusal is not carried out by another session
+---
+
+# A message from another session carries no word of the Owner's
+
+> A session that receives a message from another takes it as that session's and never as the Owner's, so a refusal one session met is not passed to another to carry out.
+
+## How it is carried out
+
+The agent harness, in every session that receives a message from another: it delivers the message marked as another session's and not as the Owner's, tells the receiving agent that such a message grants no permission and that a request to do what the sender was refused is to be declined and shown to the Owner, and its permission layer judges any action the message asks for against the receiving session's own conversation, where the Owner gave no word for it. The marking is how the agent harness delivers such a message, seen in its sessions and not in its documentation, and it rests on the agent heeding it; a session the Owner gives the word in, in its own conversation, may carry out what another was refused, because the word is then the Owner's.
+
+## Applies to
+
+| Type | Entity | Owner |
+| --- | --- | --- |
+| seat | Controller | |
+| seat | Implementer | |
+| seat | Surveyor | |
+
+## References
+
+| What | URL |
+| --- | --- |
+| The agent harness's permission modes | https://code.claude.com/docs/en/permission-modes |

model/controls/a-request-is-asked-for-its-gap-and-never-its-hotel.md

@@ -0,0 +1,23 @@
+---
+id: 01a13d68-db37-797f-86b0-67aecc352fe4
+source: Local
+kind: preventive
+mode: manual
+enforces:
+  - Nobody is asked which hotel a request comes from
+performed-by: Owner
+---
+
+# A request is asked for its gap and never its hotel
+
+> Whoever reads a request asks only for what the asker could not do, never which hotel it comes from, and a hotel's name the asker offers stays out of the restatement.
+
+## How it is carried out
+
+The Owner, in Understand, on every feature request: it reads the request as written, asks only for the gap where the request leaves it out, and restates it in the issue without the name of any hotel the asker offered.
+
+## Applies to
+
+| Type | Entity | Owner |
+| --- | --- | --- |
+| phase | Understand | Feature request |

model/controls/an-agent-s-hook-refuses-removing-a-worktree-that-holds-a-plan.md

@@ -13,7 +13,7 @@ enforces:
 
 ## How it is carried out
 
-A hook Claude Code runs on the Owner's machine before every shell command an agent issues: it reads each `git worktree remove` in the command, resolves the worktree's path through any `cd` or `-C` before it, and refuses the command where that worktree holds a plan's ledger under `.superpowers/sdd/`, saying why, so the agent stops before anything is deleted. It holds an agent and not the Owner's own terminal, and a worktree deleted some other way, such as by `rm -rf`, passes it; the hook lives in the Owner's own settings and in no repository.
+A hook the agent harness runs on the Owner's machine before every shell command an agent issues: it reads each `git worktree remove` in the command, resolves the worktree's path through any `cd` or `-C` before it, and refuses the command where that worktree holds a plan's ledger under `.superpowers/sdd/`, saying why, so the agent stops before anything is deleted. It holds an agent and not the Owner's own terminal, and a worktree deleted some other way, such as by `rm -rf`, passes it; the hook lives in the Owner's own settings and in no repository.
 
 ## Applies to
 
@@ -26,4 +26,4 @@ A hook Claude Code runs on the Owner's machine before every shell command an age
 
 | What | URL |
 | --- | --- |
-| Claude Code hooks | https://code.claude.com/docs/en/hooks |
+| The agent harness's hooks | https://code.claude.com/docs/en/hooks |

model/controls/an-agent-s-permissions-refuse-a-merge-it-was-not-given.md

@@ -13,7 +13,7 @@ enforces:
 
 ## How it is carried out
 
-Claude Code's permission layer, before the agent's command runs: it judges the action against the conversation, and a merge without a review it can see is refused, so the agent stops and the merge waits for the Owner.
+The agent harness's permission layer, before the agent's command runs: it judges the action against the conversation, and a merge without a review it can see is refused, so the agent stops and the merge waits for the Owner.
 
 ## Applies to
 
@@ -28,4 +28,4 @@ Claude Code's permission layer, before the agent's command runs: it judges the a
 
 | What | URL |
 | --- | --- |
-| Claude Code permission modes | https://code.claude.com/docs/en/permission-modes |
+| The agent harness's permission modes | https://code.claude.com/docs/en/permission-modes |

model/controls/the-implementer-reads-the-merge-before-deleting-the-branch.md

@@ -0,0 +1,30 @@
+---
+id: 01a13d68-db37-7841-a30e-fa297747437e
+source: Local
+kind: preventive
+mode: manual
+enforces:
+  - A branch is deleted only after its merge is confirmed
+performed-by: Implementer
+---
+
+# The Implementer reads the merge before deleting the branch
+
+> A branch is deleted only after the Implementer has read its pull request as merged, in a step of its own.
+
+## How it is carried out
+
+The Implementer, at the end of Integrate, once a pull request it carried has been merged: it reads the pull request's state and its merge commit from GitHub in a command of its own, and only when the state reads merged removes the worktree, the local branch and the remote branch, each by name and each as a step of its own, never chained after the merge. A branch whose merge it cannot read stays. GitHub's own deletion of a merged branch is turned off in each of our repositories, so a branch goes only when this step takes it.
+
+## Applies to
+
+| Type | Entity | Owner |
+| --- | --- | --- |
+| phase | Integrate | Delivery |
+| phase | Integrate | Contribution |
+
+## References
+
+| What | URL |
+| --- | --- |
+| Working rules | https://github.com/robertblust/conventions/blob/main/conventions/WORKING.md |