ai-agents-change-controllisted

# AI Agents Change Control <!-- vendor-portability: contributor-facing knowledge pack for the rjmurillo/ai-agents repo itself; intentionally references upstream paths (.agents/, .claude/, scripts/, build/) because its audience is repo contributors, not plugin consumers (issue #2050) --> How a change moves through this repository, and the rules that never bend. This repo runs verification-based enforcement, not trust-based. The protocol states it directly: "Labels like 'MANDATORY' or 'NON-NEGOTIABLE' are insufficient. Each requirement MUST have a verification mechanism" (`.agents/SESSION-PROTOCOL.md:36`). Every rule below therefore names two things: the gate that enforces it, and the incident that created it. If you are tempted to argue with a rule, read its incident first. Jargon used once: a "gate" is an automated check that blocks progress (commit, push, or merge) until satisfied. A "drift gate" compares generated output trees against their canonical sources. A "canonical source" is the single tree you are allowed to edit; everything generated from it is read-only output. ## Triggers - `classify this change` - `what gates does this change trigger` - `which rules are non-negotiable` - `why does this gate exist` ## Process ### Phase 1: Classify the change Every change belongs to at least one class. A mixed change inherits the union of all its classes' obligations. Classify against the working tree, not against your intent: one staged file in a stricter class pulls the