SHALL work in a git worktree unless the user explicitly overrides that rule.
SHALL not implement from the dev or main checkout by default.
SHALL treat a provided OpenSpec change id as candidate scope, not automatic permission to proceed.
SHALL verify selected change validity against current repository reality and dependency state before implementation.
SHALL not auto-refine stale, superseded, or ambiguous changes without the user.
SHALL consult openspec/CHANGE_ORDER.md before creating, implementing, or archiving a change.
SHALL finalize completed OpenSpec changes with openspec archive <change-id> (OpenSpec CLI) and SHALL NOT relocate openspec/changes/<change-id>/ by hand.
SHALL keep the internal wiki mirror in specfact-cli-internal/wiki/sources/<change-id>.md aligned when an active change’s story, scope, or dependencies change (see docs/agent-rules/40-openspec-and-tdd.md), or SHALL record an explicit follow-up when the sibling internal checkout is unavailable.
SHALL consult .specfact/backlog/github_hierarchy_cache.md before manual GitHub hierarchy lookup and SHALL refresh it when missing or stale.
SHALL require public GitHub metadata completeness before implementation when linked issue workflow applies: parent, labels, project assignment, blockers, and blocked-by relationships.
SHALL check whether a linked GitHub issue is already in progress and SHALL pause for clarification if concurrent work is possible.
SHALL perform spec -> tests -> failing evidence -> code -> passing evidence in that order for behavior changes.
SHALL run required verification and quality gates for the touched scope before finalization.
SHALL fix SpecFact code review findings, including warnings, unless a rare and explicit exception is documented.
SHALL enforce module signatures and version bumps when signed module assets or manifests are affected.
SHALL preserve existing instructions by moving them to canonical rule files before shortening the bootstrap surfaces.