# AGENTS.md

Read `CLAUDE.md` in full before changing this repository.

This repository owns the HubSpot acceptance case catalog and runner. It does
not own NexusCRM runtime, L2 pack metadata, deployment topology, or environment
secrets.

Hard rules:

- One case, one manifest entry, one read path. Every JSON case must be listed
  exactly once in `config/roles.json` and pass `node scripts/validate-catalog.mjs`.
- Never add a Production target or accept an arbitrary target URL.
- Keep PR CI provider-free. Remote mutations run only through an explicitly
  selected, protected target workflow.
- Source-backed cases must use `NEXUSCRM_L2_ROOT`; never infer a sibling L2
  checkout or copy L2 deployment config into this repository.
- Keep secrets, tokens, passwords, private keys, and sensitive response bodies
  out of cases, artifacts, logs, commits, and pull requests.
- Bind PASS/BLOCK and handoff claims to test-repository SHA, catalog digest,
  suite mode, target, terminal report, and the selected L2/runtime identity.
- A custom or dry-run result is not full-suite business acceptance.