vanillagreencom/kendex/bot-instructions

Bot Instructions

.agents/skills/bot-instructions/scripts/bot-instructions render   # write every enabled surface
.agents/skills/bot-instructions/scripts/bot-instructions check    # re-render and compare
.agents/skills/bot-instructions/scripts/bot-instructions adopt    # take hand-written files over
.agents/skills/bot-instructions/scripts/bot-instructions retire   # revoke kendex automatic rendering on removal

Flags: --repo, --spec, --staged, --output full|local, --dry-run; bot-instructions --help. Python 3.11+.

--output local limits render, check and adopt to the AGENTS.md review region. The doctrine loader selects SKILL.md or SKILL.md.disabled. The pointer uses that filename and the #doctrine anchor inside the selected checkout installation. Checkout parent paths resolve through their symlinks. The installation's own symlink keeps its checkout path. Source reads use its canonical target. An external --spec needs a matching selected installation inside the checkout. Otherwise local mode refuses: use --output full or install the package inside the checkout. Remote files are excluded from validation, adoption, writes, orphan removal and ownership reports. Local review reads the package doctrine directly; repository doctrine overrides remain in the full render. The default --output full keeps every enabled bot output. adopt --dry-run reports the content to take over and its divergence, writes no marker, and refuses symlinked targets.

Exit codes: 0 clean, 1 findings, 2 could not complete. An unconfigured repository follows schemas/validators.md § orphan, including its empty JSON ownership report. The commit-guards chain runs check --staged itself where this package is installed. A pre-commit lane blocks on nonzero codes, except an older check's unconfigured refusal carrying its renders=none attestation.

What reads what

Codex and Copilot reach the doctrine by following a pointer rather than by reading it in place. The AGENTS.md region is one directive line naming the pointed file, and .github/copilot-instructions.md carries the same pointer; CodeRabbit follows a real file reference. No block is restated to those three anywhere else, with two exceptions. render-out-of-scope rides .coderabbit.yaml's catch-all entry, where it is doing scoping work: schemas/renders.md § Doctrine routing note (a). severity rides .github/copilot-instructions.md: it holds the approve rule, which decides whether a head merges on a repo that requires an approval, so the rule goes in a file Copilot loads itself, note (b).

Routing per block and surface: schemas/renders.md § Doctrine routing. Vendor caps: references/limits.md.

The pieces

The effective manifest holds [bot-instructions]. Its child tables configure bots, repo context, cadence, exclusions, path instructions and doctrine overrides. The generator writes the enabled bots' native files. Table selection and precedence: schemas/repo-toml.md.

A [[bot-instructions.surface]] reaches Copilot, CodeRabbit and Macroscope, plus Qodo through best_practices.md when [bot-instructions.bots] qodo_best_practices is on. Only Macroscope honors exclude_globs, so narrow globs where scoping matters. The spec copy's own surfaces, § Default surfaces, reach the same routes in every repo with no manifest entry. Keys: schemas/repo-toml.md. Validators: schemas/validators.md.

• render writes every enabled surface after validating it.
• check --json reports verified whole-file paths for kendex verify; it grants no ownership of the shared AGENTS.md region.
• check re-renders and diffs, reading the index under --staged.
• adopt takes a hand-written file or AGENTS.md region under management once.
• retire lets kendex revoke automatic rendering when it removes the package. It leaves generated files unchanged.

The generator owns only the AGENTS.md § Code Review Rules region and never creates the file. A repo without the heading adds it, sets [bot-instructions.bots] codex, runs adopt, then render. A tracked nested AGENTS.md carrying that heading is a check finding. render removes each marked file the TOML no longer produces after its writes, and prints removed PATH for it. A manifest that declares no [bot-instructions] table writes nothing; schemas/validators.md § orphan says what the run reports instead. render replaces only a file whose canonical marker is present; adopt is the way in. Details: schemas/renders.md § Common rules.

The doctrine lives in one file per repo

In full mode, [bot-instructions.bots] codex writes the complete doctrine to [bot-instructions.repo] code_review_path, which defaults to .github/instructions/code-review.md, and writes the AGENTS.md owned region as one directive line naming it. A longer region is a finding: adopt reports it under agents-region and still writes the marker unless --dry-run is set, check reports it under drift, and render replaces it. A repo migrates by rendering. Body and bounds: schemas/renders.md § code-review.md.

No vendor page documents a bot following an in-file reference. CodeRabbit's code_guidelines.filePatterns is a real load, so its doctrine is not at issue; Codex and Copilot reach the pointed file only by opening what the directive names, and a bot that does not reviews with no repo rules at all. A repo enabling codex renders a canary to find out — one harmless rule that is exclusive among the files the bot under test reads, so its appearance in a comment proves the comment was written against the pointed file. A [bot-instructions.doctrine.append] on a block the copilot-instructions.md routing column does not carry gives that exclusivity for Codex and Copilot, which read no other file carrying that block; schemas/renders.md § Doctrine routing note (b) defines that column. An append to a block the column does carry, today severity, is not a Copilot canary: Copilot loads copilot-instructions.md itself, so the append can appear in its comments without Copilot following the pointer. No append is exclusive in general, since an append reaches every destination its block routes to, Qodo's and Macroscope's included. references/limits.md § GitHub Copilot code review carries the evidence and the failure mode.

Every rendered config excludes the render trees

A repo enables [bot-instructions.exclusions] derive_render or lists every render tree in [[bot-instructions.exclusions.path]]. Set construction: schemas/repo-toml.md § [bot-instructions.exclusions]. Placement and enforcement: schemas/renders.md § Doctrine routing.

A pull request changing its own review

• Run check in CI from the default branch's package copy when the two copies are byte-identical, with --spec naming the pull request tree's copy; when they differ, the pull request upgrades the package and the default-branch checker cannot reproduce the candidate's render, so run the candidate's copy and print a warning that the pull request changes the package. The package's own source repository runs the pull request's checker always.

The render inputs

• kendex.toml, plus kendex-local.toml when the root declares is_source_catalog = true.
• .kendex-generated.json when [bot-instructions.exclusions] derive_render is on.
• The spec copy's doctrine source, default surfaces and routing table.
• .bot-instructions/coderabbit-schema.json when CodeRabbit is on.
• The existing AGENTS.md when Codex is on.

Version and marker semantics: schemas/renders.md § Common rules.

Doctrine

Keep one ## Doctrine section in the spec copy. --spec selects that copy; the default is the running package. End the section at the next level-one or level-two heading. Keep each ### block ID unchanged and unique. Keep every block non-empty. Write text that YAML and TOML scalars can carry verbatim. Put repo names, paths, issues, and repo-specific rules in [bot-instructions].

scope

Raise a defect only in changed lines or code those lines directly break. Report correctness defects, security defects, data loss, fail-open paths in gates, guards, or CI, and an unnamed indirect read of another system. Do not report unrelated defects. Do not question the inclusion of a file that the PR body explicitly includes in its scope. Report an input only after establishing that a shipped producer emits it in normal use; a full disk or a value past 2^53 is not one. A change that derives another system's state indirectly (scrapes its screen or pane, reads a status line, parses output text the system does not document as an interface, or reads its internal files) must name the documented interface it stands in for and why that interface cannot serve. Report a change that omits either as a blocking finding. Reading a documented interface, text or JSON output included, is not this finding.

rounds

Report all findings about the current diff in one round. Write one comment per root cause. Name every affected site in that comment.

severity

Mark a finding as blocking only if it must stop the merge. Mark other findings as suggestions. Group suggestions together. Omit suggestions when a repeat review covers a one-line fix. Match severity and confidence to the evidence. Name the user-visible consequence in every finding.

Approve the pull request when the review reports no finding, and when every finding it reports is a suggestion or a nit. Withhold approval only for a blocking finding, and name that finding in the review. Do not withhold approval for a concern you cannot state as a finding. On a later review, a finding the author answered under the reply contract does not block approval unless the code it names changed after the answer.

no-preferences