Act III · What keeps it safe
AI Factory · Guardrails
Nine layers between an agent and main
- 01PolicyAgent side
- 02Context injectionAgent side
- 03Skills & agents catalogAgent side
- 04Agent-side hooks & harnessAgent side
- 05Local gatesLocal machine
- 06CI process checksCI on every PR
- 07CI quality & securityCI on every PR
- 08Repository rulesGitHub
- 09Human OwnerHuman
- main
How the layers connect
Layer by layer
1 · Policy
The Engineering Constitution is the single, agent-agnostic process for every change, by a human or any AI tool. Where a lower document disagrees, the Constitution wins. A ≤3 KB agent card carries the non-negotiables into every session.
2 · Context injection
The openspec CLI injects the Constitution's non-negotiables into every artifact instruction, so an agent that never reads AGENTS.md still gets the rules. The always-loaded set is held under an 8,000-token budget.
3 · Skills & agents catalog
One central catalog of skills and agents that every tool reads; no per-tool copies. Each lifecycle skill declares scope, inputs, outputs, validation and residual risks, and reports unknowns instead of inventing evidence.
4 · Agent-side hooks & harness
Claude Code hooks refuse a push to main. The local-AI harness reverts out-of-scope edits, refuses branch switches and history rewrites, freezes the red-proven TEST_CMD and owns the ledger, because a model's own claims are never trusted.
5 · Local gates
preflight.sh mirrors CI and runs as the pre-push hook. run_pipeline.sh is the dashboarded pre-PR gate. validate-sdlc-plan.sh rejects an incomplete plan or an Issue that does not exist.
6 · CI process checks
The process itself is tested on every PR: Conventional Commits, tests before production code, an OpenSpec change or an approved exception, traceability claims, archive hygiene, board coherence, Closes/Refs guard, agent rule files and product version coherence.
7 · CI quality & security
Backend unit, integration and coverage gate; frontend typecheck, lint, Vitest and build; Bruno and Playwright; OpenAPI breaking-diff; CodeQL; the security case catalog; weekly ZAP, k6 and backup-restore.
8 · Repository rules
The protect-main ruleset requires a pull request and five status checks (CI, Frontend CI, Playwright E2E, Code Lint, PR Validation), and blocks deletion and non-fast-forward pushes. The desired state is code, and a script asserts it.
9 · Human Owner
Approves specifications, is the only role that grants an exception (sdlc-exception), and alone merges Constitution amendments, exception PRs and changes to the Foreman's own harness or merge path.
What an agent may never do
- ✕Skip or reorder steps of the workflow
- ✕Implement from a prompt without an Issue and a Specification
- ✕Write code before its failing tests
- ✕Open a PR with failing CI, missing docs or reduced coverage
- ✕Commit to main, or merge on light-only green
- ✕Fabricate an Issue number, a Use Case, or a test result
- ✕Close an Issue before deploy and smoke test
- ✕Force-push or rebase a pushed branch (merge main in instead)
Exceptions are rare and human
Only emergency security hotfixes, one-time migration scripts and trivial doc typos qualify. Only the Owner grants one, with the sdlc-exception label. The label is valid only on a PR that carries no OpenSpec change, and a check enforces that. Dependency bots and the release-please PR are the only automatic exemptions.