# Bounded change contract

- Target systems/services:
- Desired observable outcome:
- Proposed mode: Operate
- Operational work size: tiny | small | medium | large | XL
- Predicted LLM quota draw: tiny | small | medium | large | XL
- Selected client/model/reasoning effort:
- Duration evidence: measured | sourced | guess with basis/uncertainty | unknown
- Human effort / agent effort / wait / outage:
- Service / network / storage / household disruption:
- Affected service tiers:
- Starts:
- Expires:
- Proposed in-scope actions:
- Explicitly excluded actions:
- External human grant reference, if a target-enforced mutation capability exists:
- Grant verification result: unverified
- Time/resource limits:
- Execution artifact absolute path and format:
- Artifact SHA-256 digest:
- Exact one-line copy/paste invocation:
- Complete package, binary, script, config, include, and generated-file closure:
- Reviewed artifact digests:
- Human-created sealed root-owned release path:
- Sealed ownership/mode/type checks:
- Required validators:
- Validators rerun against sealed bytes:
- Live/effective-state binding check:
- Prepared rollback and validation:
- Transaction-local failure cleanup: none | exact action already authorized inside this sealed invocation
- Cleanup actor, exact scope, and recorded pre-state:
- Cleanup authorization reference, deadline, and owner-hold override:
- Cleanup validators and evidence reference:
- New rollback risks:
- Owner choice for any new rollback: not-yet-asked | rollback | hold | reviewed-fix-forward
- Stop conditions:
- Host/account/shell/working directory:
- Target and precondition assertions:
- Bash/Python syntax or static checks:
- Regex fixtures or `not applicable`:
- Native validators and consumer/denial postconditions:
- Evidence capture path:
- Success marker and evidence reference:
- Success rule: exit 0 and print success only after every built-in check passes
- Failure rule: run only the recorded transaction-local cleanup, if authorized; then exit nonzero, preserve evidence and a known state, and request no second command

## Operator prompt

This agent-writable contract coordinates work; it grants no authority. Continue through safe discovery and preparation without asking after each command. Every configuration change or dependency install/update uses one reviewed, digest-bound script or fixed equivalent and one exact copy/paste invocation. That artifact contains the full dependency closure, applicable Bash/Python checks, positive and negative regex fixtures, native validation, the mutation, live postconditions, consumer and denial tests, and evidence capture. It may exit 0 or print success only after all of them pass. On failure it may run only the cleanup whose actor, scope, pre-state, authorization, deadline, hold override, and validators were sealed into that same invocation. It then exits nonzero, preserves evidence and a known state, and asks for no second command. Seal privileged inputs in an agent-non-writable path and recheck their ownership, type, mode, digests, and native validation there. A physical or UI-only task arrives once as a complete screen-by-screen packet, followed by one exact verifier invocation. Never feed commands one at a time. Freeze after bounded cleanup. Recommend a separately prepared last-known-good rollback when appropriate, explain its risk, and always ask before running that new rollback. End with the observed result, record location, and `NEXT ACTION — <actor> on <host-or-UI> as <account>: <absolute script/path or exact UI action>; expect <result>; resume when <condition>.`