# Repository rules

Product repositories contain product code, tests, and useful product documentation.
Organization tooling and shared agent workflows come from the MMI plugin.
Keep project-specific guidance in the README and architecture documents rather than copying
organization instructions into each repository.

Personal agent instructions and host settings are developer-owned, local, and gitignored.
The organization ruleset restricts AGENTS.md, CLAUDE.md, GEMINI.md, the .claude, .codex, and .agents
directories, and .cursor/rules at any depth in covered repositories. Designated distribution-source
repositories have centrally managed exceptions; a product developer must not invent a bypass.
Do not force-add ignored files or commit plugin caches to work around delivery problems.
Never disable an org ruleset (`mmi-branch-protection`, `mmi-train-floor`, `mmi-no-agent-files-org`)
by hand to push past it. When the owner has approved a bounded relaxation window, the restore is
unconditional, not a later step in the same chain: a failed push after the disable must still
re-enable the ruleset (shell `trap`/`finally`), and the run ends by reading the ruleset back as
`enforcement: active`. A one-liner of `disable && push` leaves protection off the moment the push
is rejected.

Do not create repository environment files to hold runtime configuration or secrets.
Use the declared vault and supported [keyless workflows](vault.md), including for local stages.
Renaming a secrets file or leaving it untracked is not a workaround. A runtime environment injected
by the deployment system is different from a developer-maintained file in the repository.

Use [bootstrap](../../bootstrap/SKILL.md) to provision organization-owned repository assets and
rules. Preserve product-owned content when updating managed sections.
Use `mmi-cli tests policy --base <comparison-base>` and the repository's own checks before landing.
For tooling repair, `mmi-hub status` reads state and `mmi-hub update` updates installed tooling;
repository cleanup is a separate, explicit action, not an automatic consequence of asking for help.