README.mdpolicy v9

# Fleet build directives

The public copy of the Fleet's client policy for the Oracis site page `fleet.oracis.ai/build-directives/`. Every file here is generated from one source, `src/policy/client-policy.ts`, by `scripts/policy/public-directives.ts`, which `npx tsx scripts/policy/generate.ts` runs in the same pass as every other copy; `test/client-policy.test.ts` fails when a file here drifts from that source.

Copying this file grants no permission over the Fleet and enrolls nothing. These are the instructions a client session is given, not a licence, a contract or an adoption; the policy becomes a requirement in a repository only by its owner's own act, below.

## What is here

- `CLAUDE.md`: the managed block for a repository's `CLAUDE.md`, plus, as a second section, the hosted variant of the same policy.
- `AGENTS.md`: the same managed block in the `AGENTS.md` form (the text is identical; only the file that carries it differs).
- `manifest.json`: the machine-readable copy: the policy version, the sha256 of the source and of every file here, the tool classification of each environment, and the two modes below.

## Install

Paste the block: copy the lines of `CLAUDE.md` (or `AGENTS.md`) from the begin marker `<!-- fleet-policy ... begin ... -->` through the end marker `<!-- fleet-policy end -->`, markers included, into your repository's `CLAUDE.md` (or `AGENTS.md`) at its top level, and commit it.

Or run the installer, in a repository already enrolled `fleet-first`: `npx tsx scripts/policy/install-block.ts --repo <path> --apply` (add `--file AGENTS.md` for that form). Without `--apply` it prints the diff and writes nothing.

## Update

When the policy version changes, take the new block at the new version: paste it again over the old one, or run the installer with `--apply` again, and commit. The begin marker carries the version and the sha256 of the block's body, and the installer reports the block `stale` until it is replaced.

## Remove

Delete everything from the begin marker through the end marker, markers included, and commit. Removing the enrollment is a separate, equally deliberate act: delete `.fleet/adoption.json` too if the repository is enrolled.

## The two modes

- **recommended**: advice; nothing enforced. The policy is what a session working with the Fleet is told; nothing checks or blocks, and adopting it is free.
- **enrolled**: .fleet/adoption.json makes the policy a requirement. A repository whose owner commits `.fleet/adoption.json` holding `{"version": 1, "mode": "fleet-first"}` and installs the managed block makes the policy a requirement there.

<!-- footer: policy v9; source src/policy/client-policy.ts sha256 ebaa34334fc124d2725db923e73e1883758d1d15cbf72fb32556dd1f4d72fa78; copying this file grants no permission and enrolls nothing -->

CLAUDE.mdsha256 5dfaf7a5bd25…

# Fleet build directives: the policy block for your CLAUDE.md

Generated from `src/policy/client-policy.ts` (policy v9) by `scripts/policy/public-directives.ts`, which `npx tsx scripts/policy/generate.ts` runs in the same pass as every other copy of the policy; `test/client-policy.test.ts` holds this file equal to that source. Published as the public build directives at `fleet.oracis.ai/build-directives/`.

This is the managed block `scripts/policy/install-block.ts` installs in an enrolled repository's `CLAUDE.md`. Paste everything inside the fence below, from the begin marker through the end marker (markers included), into your repository's `CLAUDE.md` at its top level and commit it, or run the installer: `npx tsx scripts/policy/install-block.ts --repo <path> --apply`.

Copying this file grants no permission over the Fleet and enrolls nothing. This is the text a client session is given, not a licence and not an adoption; enrolling a repository is the owner's decision, and `README.md` covers install, update, removal and the two modes.

## The managed block (the workstation server)

```

## Fleet policy (managed, v9)

Managed by `scripts/policy/install-block.ts` in the Fleet's code directory: change the Fleet's policy, not this block.

The `trueeval-fleet` MCP server runs outside models as **engineers** in isolated git worktrees (`fleet_build`, `fleet_mission`), delegates bounded text work to outside models (`fleet_delegate`, `fleet_review`, `fleet_council`, `fleet_research`), and gives free code navigation, affected-test runs, CI triage and worktree management (`nav_*`, `test_affected`, `ci_failures`, `worktree_*`). It spends the owner's money and runs model-written code.

Start with `fleet_ping({ repo })` (free). Its `onboarding` names the loaded build, the policy version, this repository's adoption mode, the managed block, where reports go, and `nextActions`: do those first.

### Fleet first

Default to the Fleet for:
- implementation or tests you can brief in a paragraph with the files named
- an independent review of a diff before it is merged
- a current fact from the web
- a supported browser check

The coordinator (you) keeps:
- decomposition into bounded tasks
- domain ambiguity: what the brief should say
- integration: reading the diff, running the tests, merging
- a security boundary, the money path and any protected decision

Work directly, without the Fleet, when:
- the task is smaller than writing its brief
- the capability it needs is unavailable or unsafe here (fleet_ping says which)
- it needs the coordinator's judgment across many files

Record a one-line reason for a meaningful exception (reply, commit or task board). Never redo finished work, or add busywork to a trivial edit, to satisfy this policy.

The policy is a requirement in a repository enrolled `fleet-first` (its `.fleet/adoption.json`, and the managed block in its CLAUDE.md). Elsewhere it is advice; the mandatory controls below apply wherever the Fleet is used.

### Mandatory controls, wherever the Fleet is used

- Paid calls bill the owner's OpenRouter key. You set each budget and the runtime holds it as a hard ceiling; never raise one you were given without the owner.
- Always pass `repo`. Tools default it to the server's working directory, which may be another codebase.
- Always pass `writeScope` to `fleet_build`, holding every file the acceptance needs, the seam that makes the program use the work included. Two jobs never share a file; the runtime refuses the second.
- `accepted` is the engineer's own tests, not a review. Read `worktree_diff` (for a reviewed chain, the diff its `next` names) and run the tests yourself before `worktree_merge`.
- Never run `npm install`, `npm ci` or `git stash` in a checkout with linked worktrees: their `node_modules` and stash list are shared.
- Leave nothing behind: after `worktree_merge` applies, `worktree_remove` with `deleteBranch`; remove the worktree of a job you will not resume; stop any server, watcher, browser or test run you started, and check its port is free. Never remove another session's worktree.
- A change that alters behaviour updates the register, task board and manuals that describe it in the same branch. Job history goes to the evidence system and defects to the register, never into CLAUDE.md.
- Never put patient identifiers, credentials, tokens or source content a data class withholds into a brief, a report, a review payload or a screenshot. Every repository declares its data classes (`.fleet/data-classes.json`) before any of it reaches a model.
- Free: `fleet_ping`, `fleet_status`, `fleet_stop`, `fleet_models`, `fleet_task`, `fleet_usage`, `fleet_report`, `fleet_verdict`, `fleet_intervention`, `fleet_lessons`, `fleet_scribe`, `fleet_certify`, `fleet_video_status`, `nav_*`, `test_affected`, `ci_failures`, `worktree_*`, `fleet_browse`; also free: `fleet_mission` without execute/shadow, `fleet_scrape` without extract, `fleet_look` with vision: false. Every other `fleet_*` call bills.

### Report Fleet defects at once

Mandatory. Report at once, no batching: an unexpected error or refusal, a wrong-looking result or cost, a misleading warning, a tool not doing what the manual says, a stall, a misclassified scope, a false review finding, any workaround.

- **Route:** `fleet_report({ repo, tool, observed, expected, impact, ... })` (free). Stored on this machine before it answers (`persisted: true`), redacted and deduplicated; unexpected tool errors are recorded automatically, so report what code cannot see. `mode: "list"` shows their state and released fixes not loaded here.
- **Otherwise:** If it answers `ok: false` (not stored) or does not exist (an older build), put the report in your reply to the owner. Never claim delivery without `persisted: true`.
- **Carry:** the tool; observed and expected; job, task or chain id; impact; workaround; evidence path or id, never content. `impact` is one of: wrong result, wasted spend, blocked work, unsafe instruction, data risk, annoyance.
- Then carry on with the mission. Stop only if going on risks security, patient data, money, data integrity or something destructive.
- At each checkpoint, list your report ids. Product bugs go in your register; a missing Fleet ability is `kind: "capability_request"`.
- Whenever you check a Fleet review finding, record the verdict with `fleet_verdict` (free).
- Record every hand repair of Fleet work with `fleet_intervention` (free).

### Owner approval first

- raising a budget ceiling, or spending on training
- uploading a corpus or any data off this machine
- enabling experimental routing or changing a production environment
- relaxing a data-class, sandbox, firewall or security control
- enrolling a repository (`.fleet/adoption.json`) or changing its mode
- editing global client configuration (the global CLAUDE.md, the MCP server configuration)

### Reconnecting

Never reconnect the server (`/mcp`) while this session owns a running engineer or mission (`fleet_status`: `mine: true`; `fleet_ping`: `onboarding.reconnect.safe` false): a reconnect ends them.

```

## The hosted variant: the same policy on the hosted service

The block above is written for the workstation server, which runs on the owner's machine and holds the repository's working tree. The hosted service is a different deployment of the same policy: it holds no checkout of yours, and a session connected to it works on your organization's connected repositories through the hosted tools below and nothing else. Where the block above names a tool that is not in this list, that tool does not exist on the hosted service and its sentence does not apply there; nothing in this section asks you to call anything outside the list.

Every tool the hosted service registers:

- `job_cancel`: cancel a job your organization submitted
- `job_status`: read a submitted job's state and its result
- `job_submit`: submit a bounded job against a repository your organization has connected, with its budget in cents and an idempotency key
- `lesson_confirm`: confirm or refute a candidate lesson your organization owns (owner or admin)
- `lessons_for`: the verified lessons that apply to the work you describe: each is a check to make, not an instruction
- `publish_request`: ask the publisher to publish a receipt: the conclusion and the check name come from the receipt, never from you
- `validate_status`: read a validation receipt by its id
- `validate_submit`: ask the validator to validate one candidate commit of a connected repository

The policy's requirements, in the hosted form:

- Report at once any unexpected error, wrong-looking result, misleading warning or workaround. A hosted session has no durable report tool: report it in your reply to the owner, name the tool and the job id, and record it in your own register.
- Hosted work bills your organization's allocation, never a key you hold. You set each job's budget and the service holds it as a hard ceiling; never raise one you were given without your organization's owner.
- Name the repository explicitly in every call that takes one. Your grant scopes every call to your organization: another organization's repository, job or receipt is answered as one that does not exist.
- Never put patient identifiers, credentials, tokens or withheld source content into a job brief, a lesson task or a report. Every hosted call is recorded against your organization.

**Owner approval first** (the policy's list, unchanged):

- raising a budget ceiling, or spending on training
- uploading a corpus or any data off this machine
- enabling experimental routing or changing a production environment
- relaxing a data-class, sandbox, firewall or security control
- enrolling a repository (`.fleet/adoption.json`) or changing its mode
- editing global client configuration (the global CLAUDE.md, the MCP server configuration)

AGENTS.mdsha256 1ad8cf154b27…

# Fleet build directives: the same block for your AGENTS.md

Generated from `src/policy/client-policy.ts` (policy v9) by `scripts/policy/public-directives.ts`. The block below is byte-for-byte the block `scripts/policy/install-block.ts --file AGENTS.md` installs: the policy text is never forked between the two files, only the file that carries it differs.

Paste everything inside the fence below, markers included, into your repository's `AGENTS.md` at its top level and commit it, or run `npx tsx scripts/policy/install-block.ts --repo <path> --file AGENTS.md --apply`.

Copying this file grants no permission over the Fleet and enrolls nothing. This is the text a client session is given, not a licence and not an adoption.

## The managed block (the workstation server)

```

## Fleet policy (managed, v9)

Managed by `scripts/policy/install-block.ts` in the Fleet's code directory: change the Fleet's policy, not this block.

The `trueeval-fleet` MCP server runs outside models as **engineers** in isolated git worktrees (`fleet_build`, `fleet_mission`), delegates bounded text work to outside models (`fleet_delegate`, `fleet_review`, `fleet_council`, `fleet_research`), and gives free code navigation, affected-test runs, CI triage and worktree management (`nav_*`, `test_affected`, `ci_failures`, `worktree_*`). It spends the owner's money and runs model-written code.

Start with `fleet_ping({ repo })` (free). Its `onboarding` names the loaded build, the policy version, this repository's adoption mode, the managed block, where reports go, and `nextActions`: do those first.

### Fleet first

Default to the Fleet for:
- implementation or tests you can brief in a paragraph with the files named
- an independent review of a diff before it is merged
- a current fact from the web
- a supported browser check

The coordinator (you) keeps:
- decomposition into bounded tasks
- domain ambiguity: what the brief should say
- integration: reading the diff, running the tests, merging
- a security boundary, the money path and any protected decision

Work directly, without the Fleet, when:
- the task is smaller than writing its brief
- the capability it needs is unavailable or unsafe here (fleet_ping says which)
- it needs the coordinator's judgment across many files

Record a one-line reason for a meaningful exception (reply, commit or task board). Never redo finished work, or add busywork to a trivial edit, to satisfy this policy.

The policy is a requirement in a repository enrolled `fleet-first` (its `.fleet/adoption.json`, and the managed block in its CLAUDE.md). Elsewhere it is advice; the mandatory controls below apply wherever the Fleet is used.

### Mandatory controls, wherever the Fleet is used

- Paid calls bill the owner's OpenRouter key. You set each budget and the runtime holds it as a hard ceiling; never raise one you were given without the owner.
- Always pass `repo`. Tools default it to the server's working directory, which may be another codebase.
- Always pass `writeScope` to `fleet_build`, holding every file the acceptance needs, the seam that makes the program use the work included. Two jobs never share a file; the runtime refuses the second.
- `accepted` is the engineer's own tests, not a review. Read `worktree_diff` (for a reviewed chain, the diff its `next` names) and run the tests yourself before `worktree_merge`.
- Never run `npm install`, `npm ci` or `git stash` in a checkout with linked worktrees: their `node_modules` and stash list are shared.
- Leave nothing behind: after `worktree_merge` applies, `worktree_remove` with `deleteBranch`; remove the worktree of a job you will not resume; stop any server, watcher, browser or test run you started, and check its port is free. Never remove another session's worktree.
- A change that alters behaviour updates the register, task board and manuals that describe it in the same branch. Job history goes to the evidence system and defects to the register, never into CLAUDE.md.
- Never put patient identifiers, credentials, tokens or source content a data class withholds into a brief, a report, a review payload or a screenshot. Every repository declares its data classes (`.fleet/data-classes.json`) before any of it reaches a model.
- Free: `fleet_ping`, `fleet_status`, `fleet_stop`, `fleet_models`, `fleet_task`, `fleet_usage`, `fleet_report`, `fleet_verdict`, `fleet_intervention`, `fleet_lessons`, `fleet_scribe`, `fleet_certify`, `fleet_video_status`, `nav_*`, `test_affected`, `ci_failures`, `worktree_*`, `fleet_browse`; also free: `fleet_mission` without execute/shadow, `fleet_scrape` without extract, `fleet_look` with vision: false. Every other `fleet_*` call bills.

### Report Fleet defects at once

Mandatory. Report at once, no batching: an unexpected error or refusal, a wrong-looking result or cost, a misleading warning, a tool not doing what the manual says, a stall, a misclassified scope, a false review finding, any workaround.

- **Route:** `fleet_report({ repo, tool, observed, expected, impact, ... })` (free). Stored on this machine before it answers (`persisted: true`), redacted and deduplicated; unexpected tool errors are recorded automatically, so report what code cannot see. `mode: "list"` shows their state and released fixes not loaded here.
- **Otherwise:** If it answers `ok: false` (not stored) or does not exist (an older build), put the report in your reply to the owner. Never claim delivery without `persisted: true`.
- **Carry:** the tool; observed and expected; job, task or chain id; impact; workaround; evidence path or id, never content. `impact` is one of: wrong result, wasted spend, blocked work, unsafe instruction, data risk, annoyance.
- Then carry on with the mission. Stop only if going on risks security, patient data, money, data integrity or something destructive.
- At each checkpoint, list your report ids. Product bugs go in your register; a missing Fleet ability is `kind: "capability_request"`.
- Whenever you check a Fleet review finding, record the verdict with `fleet_verdict` (free).
- Record every hand repair of Fleet work with `fleet_intervention` (free).

### Owner approval first

- raising a budget ceiling, or spending on training
- uploading a corpus or any data off this machine
- enabling experimental routing or changing a production environment
- relaxing a data-class, sandbox, firewall or security control
- enrolling a repository (`.fleet/adoption.json`) or changing its mode
- editing global client configuration (the global CLAUDE.md, the MCP server configuration)

### Reconnecting

Never reconnect the server (`/mcp`) while this session owns a running engineer or mission (`fleet_status`: `mine: true`; `fleet_ping`: `onboarding.reconnect.safe` false): a reconnect ends them.

```

manifest.json

{
  "policyVersion": 9,
  "hashing": "sha256 over UTF-8 bytes with CRLF folded to LF",
  "sha256": {
    "source": "ebaa34334fc124d2725db923e73e1883758d1d15cbf72fb32556dd1f4d72fa78",
    "files": {
      "CLAUDE.md": "5dfaf7a5bd25bca676a95bf6c1bee424542e92490708e53a2a825033c58aab3c",
      "AGENTS.md": "1ad8cf154b27dadb72c71a6c5c6c677d4ab381d648c7cfc31a1097836c1b641b",
      "README.md": "c61daa77f090c808dc56815f9f8243d502585b77bbcf5da7c0841ad9162c2375"
    }
  },
  "generatedAt": "deterministic, not a wall clock: this copy regenerates byte-identically at any time",
  "sourceRevision": "7827111058dd3a573146132e98f9b7f7d60c9d31",
  "environments": [
    {
      "id": "workstation",
      "tools": {
        "fleet_ping": "free",
        "fleet_status": "free",
        "fleet_stop": "free",
        "fleet_models": "free",
        "fleet_task": "free",
        "fleet_usage": "free",
        "fleet_report": "free",
        "fleet_verdict": "free",
        "fleet_intervention": "free",
        "fleet_lessons": "free",
        "fleet_scribe": "free",
        "fleet_certify": "free",
        "fleet_video_status": "free",
        "nav_find_symbol": "free",
        "nav_dependencies": "free",
        "nav_outline": "free",
        "nav_task_context": "free",
        "test_affected": "free",
        "ci_failures": "free",
        "worktree_create": "free",
        "worktree_diff": "free",
        "worktree_merge": "free",
        "worktree_remove": "free",
        "worktree_list": "free",
        "worktree_prune": "free",
        "fleet_mission": "conditional",
        "fleet_scrape": "conditional",
        "fleet_build": "paid",
        "fleet_delegate": "paid",
        "fleet_continue": "paid",
        "fleet_council": "paid",
        "fleet_review": "paid",
        "fleet_research": "paid",
        "fleet_browse": "free",
        "fleet_look": "conditional",
        "fleet_image": "paid",
        "fleet_video": "paid"
      }
    },
    {
      "id": "hosted",
      "tools": [
        "job_cancel",
        "job_status",
        "job_submit",
        "lesson_confirm",
        "lessons_for",
        "publish_request",
        "validate_status",
        "validate_submit"
      ]
    }
  ],
  "modes": {
    "recommended": "advice; nothing enforced",
    "enrolled": ".fleet/adoption.json makes the policy a requirement"
  },
  "notice": "Copying this file grants no permission over the Fleet and enrolls nothing.",
  "footer": "policy v9; source src/policy/client-policy.ts sha256 ebaa34334fc124d2725db923e73e1883758d1d15cbf72fb32556dd1f4d72fa78; copying this file grants no permission and enrolls nothing"
}

Item	Value
Policy version	v9
Source fingerprint (sha256)	ebaa34334fc124d2725db923e73e1883758d1d15cbf72fb32556dd1f4d72fa78
Hosted service (invited organizations)	The "hosted variant" section of CLAUDE.md applies. It names only the hosted tools: job_cancel, job_status, job_submit, lesson_confirm, lessons_for, publish_request, validate_status, validate_submit.
Workstation runtime	The managed block applies. It is written for teams running Fleet's workstation server, which Oracis uses every day and does not yet offer remotely; its installer command runs from that server's code.

Build directives

What these are

Version and where it applies

Recommended or enrolled

Install, update and remove

For CLAUDE.md

For AGENTS.md

Verify what you copied