The decisive boundaryrc.2 injects workspace instructions as durable user-role guidance. The loader can prove visibility; only a sandbox, approval gate, validator, CI rule, or server policy can prove enforcement.

Classify the claim before changing the prompt.

Loader evidenceDiscoveredsource path

The expected file entered the current instruction chain.

Request evidenceModel-visiblewithin budget

The retained user message reached this model request.

Behavior evidenceFollowedprobabilistic

The proposed action happened to comply in this turn.

Control evidenceEnforceddeterministic

A non-model boundary rejects every forbidden action.

Give hard rules a real owner.

AGENTS.md

“Do not push without approval.” Useful guidance, but the model may still propose or call the action.

Influences behavior
approval + branch rule

The tool and GitHub reject an unauthorized push or merge regardless of model output.

Enforces behavior

Choose by lifetime, not convenience.

Every DSH SessionUser-global$DSH_HOME/AGENTS.md

One fixed file, no global local-overlay.

One repositoryProject baserepo/AGENTS.md

Versioned policy from project root to cwd.

One developerLocal overlayAGENTS.local.md

Loads after base candidates in that directory.

One subtreeNested scopesrc/AGENTS.md

Discovered after structured fs work reaches it.

One task typeSkillSKILL.md

Loaded when the task matches or the user invokes it.

Baseline first. Nested context later.

Session startsglobalroot baseroot localcwd chain
Structured fs succeedsnew nestedchangedremoved
Next Agent stepone durable update

Shell navigation is not discovery.

bash: cd src

No persistent shell state and no reliable structured filesystem boundary.

Does not load nested instructions
read: src/index.ts

A successful first-party fs result reaches the descendant scope.

Queues nested instructions

One path currently has two meanings.

User-global meaning$DSH_HOME/AGENTS.md

Applies to every Session.

Wanted project meaning$DSH_HOME/AGENTS.md

Applies only while editing DSH configuration.

rc.2 provides no second official global path, so these policies cannot be separated in the same file. Treat it as global. Use direct task instructions, an explicit Skill, or a separate configuration repository for local guidance.

Budget preserves specificity.

Dropped firstbroader global prose
Preservedproject instructions
Preserved longestmost-specific file

Prove the active chain.

Primary evidence.

Keep the complete scope runbook.

The canonical guide covers visibility proof, authority, scope, refresh, budgets, concrete rules, deterministic enforcement, adversarial testing, and acceptance.

Read the complete guide