Repo contract

Repo-wide invariants

Keep shell input, redraw, and live updates bounded; do not introduce user-visible blocking or unbounded hot-path work.
Rivet is a transparent harness. Preserve agent/provider semantics and do not author assistant behaviour.
Keep durable execution truth, model-input truth, and operator presentation as separate contracts.
Curate the UI, not the model's voice.
Lossless native > structured fallback > omission > narrated fiction.
Keep lane-first semantics explicit. Do not introduce session-global mutable current-lane or current-agent state.
New async or concurrent work must define publication, durability, cancellation, and budget semantics up front.
Prefer explicit contracts, bounded registries, and focused modules over hardcoded branching in shared paths.
Prefer correct ownership over convenience. Move or delete code that lives in the wrong layer.
Handle errors explicitly; do not ignore, drop, or silently translate them.

Do not preserve legacy paths, compatibility shims, placeholder flows, or dead code.
Prefer deletion over preservation when a seam no longer serves live behaviour.
Before architecture-sensitive changes, make owner boundaries, typed seams, deletion posture, and the first execution slice explicit.
Update nearby design docs and the nearest authoritative AGENTS.md in the same change when durable behaviour or local rules change.
When changing Rivet-owned persisted config shape, schema, or config persistence/load paths, update scripts/generate-config-schema.py, regenerate schemas/rivet-config.schema.v1.json, and keep docs/tests in the same change.
Public-facing capability, onboarding, provider/privacy, or release-positioning changes must update README.md and docs/status.md when they change what a first-time reader should believe.
Keep scoped AGENTS.md files as concise behavioural contracts. They should add or narrow rules, not become discovery guides.

Automated verification must stay offline and fail closed before any real API use. Use deterministic scenario-mode flows where provider behaviour is involved unless the owner explicitly asks for live rehearsal.
Shell-visible behaviour should default to deterministic ui-semantic coverage. Use ui-sandbox only for real boundary-sensitive UI proof and smoke only for startup sanity.