# Web guardrails

Run these from the repository root when changing AgentTeam Web architecture boundaries:

1. `guardrails/web/workspace-boundaries.sh` — checks the workspace frontend boundary contract in `specs/web/workspace-boundaries.md`.
2. `guardrails/web/sidebar-typography.sh` — keeps level-2 sidebar title and metadata sizing inside the shared semantic row primitives and rejects retired call-site title layouts.

## Fast harness debt ceilings

`scripts/harness-fast.sh` owns the active workspace ceilings. They were last
regenerated from `origin/main` at `46687fab87cf`; this revision is
non-normative inventory provenance.

| Inventory | Active ceiling | Debt owner | Why the debt is temporarily accepted | Retirement condition |
| --- | --- | --- | --- | --- |
| Root workspace files outside the allowlist | `0` | The matching `web/src/agentteam/workspace` domain | No unlisted root file is accepted | Put new code in its owning domain or explicitly review an allowlist change |
| Cross-domain or workspace-to-page private imports | `0` | The importing workspace domain and the domain that owns the public entry | No private boundary violation is accepted | Export a narrow owning-domain contract or move genuinely shared code to `workspace/shared` |

New root files and private cross-domain imports are forbidden. An increase
requires a reviewed scope plus an updated owner, reason, and retirement
condition here.