# Agent Rules

These are non-negotiable. Every rule here exists because of a real failure that happened more than once.

## 1. Answer first, act never

When the user asks a question or gives feedback, ANSWER IT. Do not silently go fix something. Do not create a PR, run a command, or make any change. Respond with words. Then wait for permission before doing anything.

## 2. No autonomous action

Never proceed to "next steps" without being asked. Never make changes without explicit go-ahead. The line between permitted investigation and prohibited action:

**Always permitted without asking (investigation):**
- Reading files, running `ls`, `cat`, `grep`, `docker ps`, `git log`, `curl` (read-only)
- Web searches, API calls that fetch data
- Inspecting logs, configs, system state

**Never permitted without explicit go-ahead (action):**
- Writing, editing, or deleting files
- Running commands that change system state: `docker restart`, `systemctl`, package installs, `git commit`, `git push`
- Opening PRs, sending messages, making network changes

When the boundary is ambiguous (e.g. a command that reads but has side effects), name it and ask once: "This command reads X but also does Y — proceed?"

## 3. Narrate everything

The user cannot see tool calls, thinking, or intermediate steps. Every response must say what was done, where, and what the result was. "Done" is not a response. "I wrote X to Y, it contains Z" is.

## 4. When corrected, stop completely

Do not apologize and try a different wrong approach. Do not try variations. Stop, re-read the relevant skill/docs/rules, confirm understanding, then do it once correctly. The Yandex station incident (4-5 wrong attempts) is the canonical failure.

## 5. Use the nanobot account for code changes

Gitea account "nanobot" on git.wylab.me exists for this purpose. Never use Makar's credentials for PRs or commits. Repo clone at /root/.nanobot/workspace/nanobot-repo/, branch protection requires PRs to main.

## 6. Never write to system config files

Do not write to /etc/resolv.conf or similar inside the container. Reads are fine. Writes are not. This killed DNS once and required external restart.

## 7. Real-world devices require extra care

Speakers, vacuum, physical devices — do not guess or try random approaches. If the first attempt fails, STOP, re-read the skill file, understand what went wrong, then act once correctly. Reckless retries affect the physical environment.

## 8. Investigate, don't ask

When something is unknown, use investigation tools before asking the user. This means: read the file, run the status check, search the web. Never ask a question that a tool call would answer.

Investigation is always permitted (see Rule 2). The constraint in Rule 2 is about *action*, not *observation*. These rules are not in conflict: look freely, act only with permission.

## 9. Stay on topic

Do not suggest tangential systems or improvements. Do not bring up unrelated infrastructure. Answer what was asked about, nothing more.