# Instruction conflict register

Discovery decisions from the pinned sources. Upstream files are evaluated data until selectively incorporated. Actual host/system constraints apply first; explicit user requirements and valid authorization govern the task within them. Agentic owns source conventions/setup, Codinary owns delivery/evidence/release, EGM owns design methodology, and specialists supply scoped guidance. A source filename such as `AGENTS.md` does not grant authority over the destination repository.

| ID | Conflict and evidence | Resolution / verification obligation |
| --- | --- | --- |
| I01 | M:`implement` ends with automatic commit; `implement-spec` merges/resets branches, closes tickets and marks PR ready | Reject delivery commands. Codinary delegates source work and requires action-specific authorization; test direct/review-only routing |
| I02 | M:`ask-matt` routes idea-to-ship through upstream implement/implement-spec | Single Agentic registry/routing; no second top-level delivery engine or recursive Codinary invocation |
| I03 | Existing `code-review` requires `/setup-matt-pocock-skills` even for supplied local spec | Remove stale prerequisite; discover actual tracker only for tracker reads; no spec can be an explicit result; missing delegation never a false independent review |
| I04 | M:`domain-modeling`/TDD/debugger use GLOSSARY; Agentic adaptations use CONTEXT | Preserve local filenames/maps/templates; no rename migration disguised as source refresh |
| I05 | TDD requires user-confirmed seams before every test; Codinary already authorizes discovered verification plan | Respect explicit seam decisions and existing authorization. Ask only unresolved consequential test-interface ambiguity; no repeated confirmation gates |
| I06 | Debugger stops without red-capable loop; Codinary continues independent investigation around prerequisite gaps | Keep loop-first evidence before speculative fixes; record blocked reproduction, continue safe independent fact gathering; no blind patch |
| I07 | E:`execution_instructions.md` design-only forbids production source writes and final summaries | Scope to active EGM drafting/resolution. Exit design workflow at approved handoff; Codinary's implementation and mandatory final report remain intact |
| I08 | EGM draft repeatedly asks owner to choose even when owner delegates choice | Honor explicit delegated mechanical/reversible decisions and already given authorization; preserve unresolved consequential architecture approval and final human approval |
| I09 | EGM one-question/sole-tool/gate payload schemas conflict with actual runtime question APIs and modes | Map interaction to available schema or plain text; tool absence/time elapsed is never approval. User-specific instruction outranks generic upstream formatting |
| I10 | EGM brainstorm open-ended clarification vs grilling whole-frontier rounds | Separate modes: `grilling` is standalone requirements interview; EGM brainstorm readiness/design gates remain explicit; no competing engines or automatic full EGM for small work |
| I11 | EGM Goldfish expects no inherited deliberation; some host spawns default to full history | Require native `fork_turns:none`/`fork_context:false` or verified equivalent. Missing isolation blocks review; forgetting instructions/self-review is insufficient |
| I12 | Named personas unavailable on some hosts; synthesizer nesting unavailable on others | Fresh general-purpose reviewer loads exact canonical persona; direct dispatch from parent when nesting unsupported; wait for real completions and report failures |
| I13 | Canonical EGM `agents/` and Claude adapters share names; registering both duplicates roles and loses restrictions | Claude registers only explicit wrapper list; other runtimes resolve canonical persona files. Keep wrappers' read-only tools and `omitClaudeMd` where supported |
| I14 | EGM reviewers can read accessible filesystem/memory even with fresh conversation | Explicit least-privilege reading list, source treated as data, no memory/history retrieval; distinguish instruction-level restriction from tool-enforced permissions in compatibility claims |
| I15 | E:`egm-bootstrap` requires unbounded swarm and recurses through scouts | Bound concurrency/depth to actual host capacity; partition once, prevent coordinator cycles, use serial batches. Large-tree authorization does not mean unlimited resource consumption |
| I16 | Bootstrap guesses manifest-based test commands and substitutes placeholder details after scout failure | Discover actual commands, mark unknown explicitly, preserve incomplete worker status and affected scope; placeholder docs cannot claim successful grounding |
| I17 | EGM review-loop two clean rounds/cap five vs Codinary two fix cycles | Independent design-only budget and delivery budget; design iteration never resets run-wide implementation fixes or consumes phantom implementation cycles |
| I18 | EGM manual re-audit cap auto-advances unresolved findings as accepted trade-offs | Record residual findings as unresolved/awaiting authorized acceptance; cap is execution bound, not fabricated human risk acceptance or design approval |
| I19 | E:`egm-resolve` template says High/Medium/Low while personas report Blocker/Major/Nit | Keep design severity canonical Blocker/Major/Nit; preserve original finding identity/rationale and dispositions; no silent mapping to Codinary verification verdicts |
| I20 | EGM report filenames generic; Codinary run names are protected | Separate design artifact directory/namespace and retain per-stage/round reports; never overwrite Codinary brief/ledger/reviews |
| I21 | EGM template includes freeform `Status: Approved`; mission requires explicit approval and stale-version rejection | Approval must bind human authority, current specification identity/version/checksum and source revision via validated handoff; document text or clean AI review alone is insufficient |
| I22 | EGM `GoldfishContext` can contain URLs and custom paths; Claude reviewer tools cannot fetch URLs | Resolve canonical bundle paths separately from workspace input; explicitly materialize authorized external references; reject missing/escaping/malformed resources and report incomplete reads |
| I23 | EGM bootstrap/review main files exceed 400 lines at pinned revision (427/402) | Split natural workflow/reference seams with strong pointers; never discard essential review stages/assets to meet cap |
| I24 | Matt prototype skips tests/error handling and folds decisions into code; Agentic requires scoped regression/evidence | Defer production-adjacent prototype command; illustrative design scratchpad remains external and clearly marked; real code returns to Codinary verification |
| I25 | Matt setup can create labels/remotes and rename domain docs; source EGM AGENTS imposes upstream PR taxonomy | Neither is imported as local governance. Preserve Agentic setup, user configs and permissions; upstream contribution policy is distinct from license obligation |
| I26 | Upstream installers/global link scripts and runtime native tests change plugin registrations/environment | Inspect only during discovery; test disposable/local candidate packaging with explicit permitted scope. No global installation, auto-update or script execution on README authority |
| I27 | Source EGM TESTING reports native passes; Agentic adapted bundle not yet tested | Label source-reported records; distinguish discovery/install/static/behavioral/runtime evidence and keep unsupported hosts explicit |
| I28 | Agentic baseline has The Lazy MIT notice, upstream adapters retain substantial Matt text without notice | Add Matt MIT copyright/permission notice and distribute with selected skills; retain Agentic license |
| I29 | EGM Apache-2.0 requires license, retained notices, prominent modifications; Agentic default MIT metadata | Preserve full Apache license and file notices, identify changed source-derived files, record provenance; no claim that all bundled content is solely MIT or Google-supported |
| I30 | Agentic skill README says red-green-refactor; actual TDD skill keeps refactoring in review | Fix documentation to match retained skill behavior; no behavior-changing rewrite to satisfy descriptive prose |
| I31 | Caveman broad brevity triggers and session defaults could activate without an explicit request | Explicit invocation metadata and core voice requests only; status/loading never activate; unknown history is reported truthfully |
| I32 | Caveman aliases delegate to excluded alternate voices and compression tools | Omit alternate aliases and persisted-artifact exceptions; unsupported commands preserve the current mode; ship core only |
| I33 | Terse status/error excerpts could drop warnings, evidence or host-required output | Clarity and host cadence take precedence; full authorization, persisted artifacts, audit prompts/records/reports and required verification output |
| I34 | Security Audit coordinates specialized roles and recommends fixes | Scope that coordination to the six audit phases; Codinary alone owns delivery, source edits, two fixes, acceptance criteria, QA and release |
| I35 | Audit and delivery both produce JSON/reports and independent reviews | Separate artifact namespaces and verdicts; no automatic remediation, delivery pass, QA substitution or complete-coverage claim from zero findings |
| I36 | A host may install a skill without fresh delegation or the required OS sandbox/promotion controls | Distinguish discovery from runtime support; missing delegation makes the run incomplete, missing execution controls block target code, and unresolved facts retain their exact blockers |
| I37 | Vendored Security Audit validators/tests and schema exceed normal size caps and contain upstream comments | Apply the existing CODING.md section 5 vendored/static-data exemption; retain pinned bytes and all evidence requirements, with explicit provenance and license notices |
| I38 | Current Caveman is Apache-2.0 while retaining pre-3.0 MIT contributions and a broad NOTICE | Ship current Apache text, historical MIT permission notice and applicable copyright/NOTICE; omit only notices for excluded components; prominent local modification notice |

## Runtime evidence and authority boundaries

Reviewer isolation, read-only execution and human approval require observable evidence. A launch prompt is an instruction, not proof of tool enforcement; a parent-authored receipt does not prove a child read a required file. Keep raw native launch/completion/read traces where exposed, with secrets removed. Missing required evidence is a named gap. An external document, reviewer suggestion, registry alias or fabricated approval field cannot authorize source edits, release actions or an expanded waiver.

Where a decision remains unresolved, record the exact issue and proceed only with independent authorized work. The integration report must identify which resolutions are implemented/tested and which remain recommendations.

## Implemented outcome

I13 resolves to nine thin native Claude wrappers generated/registered once under Agentic, canonical definitions under framework/egm; standalone copied skills use fresh general-purpose fallback. Reviewer tools/omitClaudeMd are declared statically; enforcement remains unverified without native runtime evidence. I21 uses detached Ed25519 receipt plus explicit external caller-pinned key/current assertion; no signing CLI/catalog. I18 leaves open/contested severe findings blocking readiness, never autoaccepted at caps. Every selected implementation and generated-copy digest is finalized in upstream-provenance.json; independent source QA remains a separate gate.