Governed code

<!-- sflow-copilot-pause -->

First run singularity-flow phase enter --compose --for-agent --json once in every turn, also after an interrupted one: an earlier turn's entry is context, not this turn's binding. It composes context only when admitted. Lookup from current cwd (non-Git allowed). Never search /Users, $HOME or parents for a repo. Require returned ready/workId/repositoryPath; unavailable: /sf-session or /sf-workspaces, stop. It checks pause before Git. If paused, native Copilot; only offer /sf-pause off, never resume implicitly. Otherwise follow agentGuide.readOrder once, reuse binding/recovery/clarification/references and delivered inputs from this entry; no duplicate lookups. Read clarification.checkpoint: missing answers permit questions, not drafting. Missing record is not unanswered: reuse same-binding replies; repair recording. Never ask users to supply questions or slice control instructions. Use personalization.replyName literally in replies, never artifacts or approval identity.

<!-- sflow-output-contract: clarification-and-artifact -->

Output contract: Author configured artifacts from governed inputs and pinned clarification; publish only after readiness. Approved phase inputs are the earlier steps' outputs and settle what they state: never ask what they answer or search elsewhere for them. Summarize artifacts with verified Markdown-preview links; never paste document bodies, code or diffs into Copilot. For code, list touched paths and observed added/deleted/created line counts; unavailable stays unavailable. Use existing evidence, not extra calls solely for display. Summaries, links and opened previews are not human review or approval. For every next action, honor returned commandGuidance in order: Copilot, Shell, VS Code (model-free) using modelFreeCommand; if absent, say "not available for this action". Missing Copilot: "no verified equivalent". Never invent routes. On a refusal read remediationPlan: run its first read-only step once and follow context.strategy; never retry an unchanged condition or edit an earlier phase to clear it. One returned automatic plan-hash action (such as sync) may run once, then re-enter once. When a result's act.state is author, or it routes back to this skill with nothing for a person to answer, edit, review or confirm, that is this turn's own work: do it, never relay it. A file edit that does not match is not a refusal: read the file again and redo the edit. Run a check only when a returned field or command asks for it; never decide from a step's name, kind or route that it applies. A refusal saying a check does not apply to this step is not a blocker: skip it and continue. Act on a result's act first: its state, do routes and any ask. A bounded result names agentOutput.read ranges and omittedFields text files; read all in one response with your file tool. If your host saved a result to a file you cannot open, run that command again with --for-agent --json; never read the host's copy with shell tools.

<!-- sflow-execution-boundary -->

Boundary: reuse entry ready/workId, valid phaseAgent; cwd=repositoryPath. Honor mutationContract. Returned workItemRoot/artifact paths only; never $HOME. Use exact CLI-returned paths. repositoryPath is command cwd, not a prefix for absolute file paths. Never rebase paths or strip .git/worktrees. Issued private/external files are exact exceptions to repository confinement, not wider read/write permission; writes still need authorization. Resolve relative paths only against their declared base. On failure, preserve the path and error; never search or recreate it. Blocked: relay resolution.issues[].choices too. Eligible risk needs reason/expiry and authorized human confirmation. Never auto-accept risk.

1. Require entry phase, phaseAgent.valid: true, generatesCode: true, authoring.policyVerified; else relay routes, never draft sign-off. Read mutationContract/authoringProgress: binding is not source permission; kernel-only /sf-next cannot author.
2. Review recovery, intent, test handoff and exact diffs/untracked bytes including workflow.json. Pending evidence: preserve files/index, repair draft; never accept evidence. Otherwise stop on protected/unrelated/unowned edits or lifecycle/authority blockers. Repair owned open-intent actions; runner repair requires CODE_DELIVERY_TEST_COMMAND_REQUIRED (no in-scope runner: offer /sf-test-setup and keep coding). Untracked .sflow/results/** need no cleaning; review tracked/staged reports. Consumed-changed intent needs reviewed rollover; unchanged publication: relay next, stop. Require open intent; absent: singularity-flow phase begin <phase> --json with adoption/confirmation before edits/composition; never auto-adopt. Successful begin: refresh entry once. Consumed intent requires /sf-recover.
3. Use entry context.text; if not-requested or stale, rerun it once with <phase> --work-id <WORK-ID> --compose. not-admitted: relay blockers/next, stop.
4. Follow clarification.checkpoint; off skips. Reuse same-binding human replies; ask only unanswered/changed questions with ask_user (unavailable: show them and stop; stage chat replies). File-edit {"responses":[...]} at clarification.responseStagingPath; run checkpoint.recordAction alone. On refusal preserve replies/staging; repair recording, not questions. Remove staging only on success; record before code mutation; refresh entry once. Staging is JSON only, never handwritten governed records. A new question while coding: never re-ask recorded ones. If the person here can decide it, ask_user, stage only that reply, run checkpoint.newQuestionAction alone. Otherwise, or none is returned: keep coding on the most conservative reading, list it under ## Upstream discrepancies, run singularity-flow upstream-issue raise --from-artifact.
5. Verify references; refuse invalid/dirty. generation > 0: singularity-flow revision status --for-agent --json. Source edits need codeAuthoringReady: true, context/clarification. Preserve code/tests; prepare missing artifact via authoringProgress. Preparation is not authoring.
6. Native file-edit tool: finish behavior/tests/artifact/Agent brief and planned bindings. Keep planned test files; assert behavior, never fabricate tags. Preserve managed blocks. Doc-comment APIs; tags aren't docs. Exclude fixtures/docs/deletions/symlinks. Use the file's comment syntax (//, #, --, /*, <!--). Product: @clause:<WORK-ID>:REQ-001 rationale (REQ|BEH|IFC|AC|CON); tests: @ac:<WORK-ID>:AC-001 above the test. Honor pinned test-only opt-outs. Follow toolProtocol.localVerification for tests/app start/stop and exact mutationContract.artifacts evidence. No VS Code task is required.
7. Follow testExecution.handoff; argvWithheld: true means configured, not missing. No adoption/amendment for redaction/inference or reporter flags. Development tests are allowed during authoring; report argv/cwd/exit/failures. Publication still runs fresh governed tests; manual passes never advance. Never infer withheld argv. runnerStatus: blocked: fix that delivery finding first. No skip/list/dry-run/no-tests. Authorized dependencies only; never edit protected config, disable hooks or fabricate results.
8. Run singularity-flow phase prepublish <phase> --for-agent --json --publish-if-ready (includes draft-check). Follow correction.class/sameTurn, traceabilityRepair.actions; verify hashes, repair tags without asking. Never invent, pad, delete markers, nest models or overwrite producers. ready is not test success. Follow returned repairLoop.protocol; stop unchanged.
9. Use returned commands.publish once when ready unless publishIfReady.published; successful required tests continue publication. Advisories/requiredBefore: approve don't hold. Absent: relay commands.next, stop. Refusal: report command ID, argv/cwd, exit, bounded stderr/guidance. Nonzero exit fails despite passing JUnit. No test ran: relay testRunRisk.command to a step approver; never run it. /sf-recover: proven runtime repair permits retry without source changes. ARTIFACT_AUTHORING_INCOMPLETE: recheck/retry once. Never submit/approve.
10. publishIfReady.review: viewing only, hash-bound references. Relay publishIfReady.next after publication.

TRP: singularity-flow explain test-recovery.