Agentic Mettle is an experimental local protocol and helper, not a sandbox, credential manager, or proof that a model will follow its instructions.

Inspect the deployed Python helper, fixed protocol, and exact hook commands. Use the runtime's normal project trust and hook review mechanisms. Do not bypass trust, grant the entire home directory, or change repository policies merely to make a test pass. Config files are merged and changed versions backed up; review both the resulting config and machine-local backups before sharing them.

The helper uses only the Python standard library and makes no network or model calls. The agent runtime may transmit anything it reads to its configured model provider, including local profiles, source excerpts, and memories.

Identity and assigned commitments are operator-maintained. Learned dispositions, self-assessments, and experiences are fallible data. They cannot grant authority or override system/user instructions, component requirements, or permissions. Native hook context has the runtime's instruction priority. Labelling mutable memory as data reduces ambiguity but does not provide technical isolation against prompt injection. Never put secrets or arbitrary third-party instructions in a profile to make them load automatically.

Accepted records must normally be published through the helper. It validates schemas, paths, references, and revision history, but it cannot verify causal truth, prevent a model inventing evidence, or stop another program editing files. The lock serializes helper operations, not independent concurrent agent lives. Run one authoritative writer for the single V1 personality.

The installer uses the explicitly designated target directory and creates a root AGENTS.md if missing, after configuration and history validation. The CLI/wizard can prepend or append one marked, static activation block; skip leaves an existing file unchanged. Unrelated instructions are preserved and changed files are backed up byte for byte. Malformed markers or detected intervening edits fail visibly. Exclusive creation cannot overwrite a concurrent operator file. This operator-approved setup is not learned-lesson promotion. Symlinked root instruction files and state paths, Windows junctions, and other reparse-point entries are rejected. Archive traversal checks entries before descending and reports unreadable subtrees. Windows drive-relative paths, reserved device names, trailing dots/spaces, alternate data stream syntax, and case-insensitive logical ID collisions are refused on Windows. New IDs/domains must be portable on every OS. Existing POSIX-only histories remain readable on POSIX; on Windows incompatibilities are reported, never silently renamed or discarded. It does not modify instructions outside the managed root block, create CLAUDE.md, or edit component instruction files. Generated runtime files contain absolute paths; rerun configuration after moving the checkout. Installation is atomic per file, not a transaction spanning all configs.

Native Windows support initially targets local NTFS. Other Windows filesystems, network shares, synchronized directories (including cloud-backed reparse points), and unusual case-sensitivity settings are not qualified. A fully written/flushed temporary file is published with os.link for immutable records; os.replace updates generated views. There is no unsafe copy/overwrite fallback if the filesystem refuses those operations. Cooperating helper readers take the same lock as writers. Sharing violations, lock contention, and I/O errors remain visible. This does not promise power-loss durability or defend against a hostile process racing path checks or editing the archive directly.

The installer validates a concrete Python 3.11+ executable and generates UTF-8 launches. Claude's exec form needs no shell. Codex's native Windows hooks use CMD; % and ! in executable/target paths are refused before any installation writes because CMD can expand them inside quotes. Runtime trust and hook approval remain necessary. No execution-policy bypass is generated. JSONC requires a manual merge; changed JSON configurations retain their exact original bytes in backups. Reconfiguration changes operator-owned launches, never learned history.

Mutable state is ignored by the installed package's .gitignore. Git ignore rules are not privacy protection, backup, or permission separation. Use appropriate filesystem permissions and an explicit backup/retention policy. Avoid storing credentials, unneeded personal information, complete command environments, or unredacted transcripts. Evidence can be a minimal excerpt and a source reference.

Append-only means normal historical preservation, not a denial of authorized erasure. V1 has no automated erasure command. An operator can redact sensitive material and leave non-sensitive tombstones explaining affected references, then run validation. Do not publish private evidence in bug reports.

Interactive setup asks for confirmation after showing the plan. A dry run and pre-confirmation cancellation write nothing to the target. Non-interactive mode uses explicit flags and documented defaults; it does not bypass validation or trust. Presets define operator-assigned starting preferences, not demonstrated skills, learned behavior, or expanded authority.

Existing profiles are preserved by default. Replacing a selected identity or dispositions file requires explicit approval and keeps its exact prior bytes in a backup. Replacement affects the entire selected file, including learned content; review the preview first. Self-model and accepted history are never reset. Custom profile content is shown in previews/JSON: avoid secrets and protect terminal logs and backups. Installer choices are saved locally, separately from learned evidence.

Plan hashes and cooperating-reader locks detect changes during normal setup; they do not make external edits transactional or provide an adversarial race barrier. An interrupted apply can leave a partial installation: inspect it and its backups before retrying. There is no automatic rollback, uninstall, backup pruning, or restore command. See the installer guide.

A stale current view is recoverable with reindex --repair; this does not alter immutable revision files. Before removing a stale .write-lock, establish that no writer is running. Back up the store before manual repair. A failed schema check is not permission to delete contradictory evidence until the check passes.

Report reproducible issues through the repository with synthetic/redacted data. Do not disclose exploitable private-project details publicly. Runtime loading failures and longitudinal behavioral failures should be reported distinctly.