/agent-protocol

name: agent-protocol
description: Use when producing any agent response

Agent Protocol

Every agent turn writes one contract -- what it was asked, what it found, what it changed, how it ended -- during the turn, not composed at the close. The twelve principles run that arc, ground to close.

1. Your contract is the delivery; your final message is only the signal that the turn ended

The gate validates only your persisted contract: one found unfinalized -- or no row at all -- rejects the close however complete your message reads (`hooks/adapters/subagent_stop_core.py::_resolve_subagent_stop_gate_full`). The message carries no copy. Address it to the orchestrator, in two lines: the closing state and the `contract_id` -- nothing the row already holds.

2. You were born with a contract -- adopt it, do not create another

`# Your Contract` names it on a fresh dispatch, a `# Contract Draft (resumed)` block on a resumed one; your first `gaia contract set/add/fill --draft-id <contract_id>` adopts that draft, and every later call carries `--draft-id` too -- omitted, the CLI targets the most recently touched draft, which is not necessarily yours. The harness stamps `agent_status.agent_id`. `AGENT_ID_FORMAT` (`gaia/contract/validator.py::FormErrorCode`) checks the identifier's shape, never its ownership, so a stray `gaia contract init` mints a rival identity the gate accepts while your real contract is reaped unfinalized; a bare `init` fits exactly one turn, the one that arrived with no contract block at all.

3. Ground yourself before acting

Ask what already governs this, in precedence: injected context -> memory, queryable past the sample you were sent -> the code, which outranks any description of it -> the skills -> outside. A skill the code refutes is outranked by it AND is itself a finding: name the skill and the contradicting symbol in `open_gaps`, or the drift outlives your turn to be rediscovered by the next agent that trusts it. A goal often carries a COORDINATE -- a contract id, a memory slug, a brief name -- and `read-map.md`, beside this file, is the verb that opens it. Announce no tool sequence and claim no reach in advance.

The ladder orders where you look; what governs an object is its owner's implementation of the act. What you can read of an object from the side that consumes it is its inventory, never its procedure, and what a goal asserts about the world is a claim your reads may refute however it is filed -- only what it asks of your conduct binds you. A procedure for an object you do not own, whether you would run it or hand it on, goes in `cross_layer_impacts` naming the owner, never in your steps: written from the consuming side it is a flawless procedure for the wrong system, and whoever runs it becomes the only one left who could know better.

Injected context is also something your reads can refute. When a value you observed contradicts a section injected into your kernel or read with `gaia context get-contract`, propose the correction in `update_contracts` -- the section, a payload holding the new value, and a `drift` object `{key_path, old, new, command, observed_at}` whose `command` is the T0 read that observed it -- and a memory row it contradicts in `memory_delta`. Calling the context stale only in prose loses the correction: finalize warns when `report_prose` or `open_gaps` say so while `update_contracts` is empty.

That precedence settles claims about existing behavior, not the quality or permission of that behavior. A normative requirement is not refuted merely because current code violates it; use `code-standards` for that distinction when producing or judging code.

4. Local and reversible work just happens; what goes out into the world is asked once, and you run it

Commits, files and branches need no signature; operations that leave the local workspace follow `security-tiers` classification. When that routes to T3, `subagent-request-approval` owns request construction and `execution` owns the post-grant lifecycle.

You run every command the work needs, a signed one included; a person receives only what is irreducibly theirs -- an interactive login, a value only they hold typed at a hidden prompt, a judgment that is theirs -- or a command a Gaia defect keeps you from running, handed over named as the defect it is, in `open_gaps` and as a proposal in `memory_delta`, so the handoff lasts until the defect is fixed. A runbook written for a human operator describes what must happen, not who does it: read it as the sequence of effects, run each step yourself, and request the T3 ones as one set through `subagent-request-approval`. The person's steps go in `conclusion` as a block headed `Human steps:`, one step per line with why it is theirs, each ready to paste and run with its values filled in, and only those -- the orchestrator reads a step an agent could run as the cue to resume you with it (`agent-response`).

Approval is authority to attempt execution; it is never evidence that execution happened. When consuming a failed COMMAND_SET result, reconcile and report the completed indexes, the failed index, and untouched indexes as three distinct states. A failed COMMAND_SET is terminal/frozen: route any retry or untouched work through fresh investigation and the approval branch rather than inferring that the original decision still authorizes it.

5. The record is written in flight, at the cadence of what would hurt to lose

If the turn is cut, only what you already wrote exists; everything else survives in the transcript as narrative and dies as evidence. Write a finding the instant re-deriving it would cost more than recording it, and be resumable before any step whose outcome you cannot predict -- a record composed at the close is a second telling, made under the pressure that ends the turn, and it drops fields. Seven lists carry it: `fill` each ONCE (it refuses to discard), `add` extends, `set` replaces, as the evidence arrives, never i