Skip to content
Corex

Using AI agents safely

CoreX is built to be worked on by AI coding agents as well as people. The repo’s agent rules live in AGENTS.md, CLAUDE.md, .specify/memory/constitution.md, and ../../../../../docs/internal/COREX-WORKING-GUIDE.md. This page summarises the rules that matter most and adds the client-site boundary.

The standing agent rules

Section titled “The standing agent rules”

Before changing code, an agent should:

  1. Read the constitution (.specify/memory/constitution.md) first — it overrides everything.
  2. Read PROGRESS.md for the current state, and the active spec for the module being touched.
  3. Run git status --short --branch and never work directly from main — use a feature branch.
  4. Not create .worktrees without explicit owner approval; work from the normal project root checkout.
  5. Install the required guard skills if missing, and run them on the diff before presenting it: clean-code-guard (any production code), wp-guard (WP/admin/REST/AJAX/query), woo-guard (WooCommerce), test-guard (tests), docs-guard (docs).
  6. Run the relevant tests/builds, update PROGRESS.md and DECISIONS.md, and end with a NEXT STEP block.

Framework work vs client-site work

Section titled “Framework work vs client-site work”

The single most important distinction for an agent is which codebase it is editing:

  • CoreX framework work — changes to this repo’s theme/, plugins/*, addons/*. These affect every site built on CoreX. Hold them to the constitution and the guard gates.
  • Client-site work — changes to a generated client site (plugins/<slug>-site/, themes/<slug>/) made with wp corex make:site. This is where a client’s brand, structure, and content belong.

Rules for client work:

  • Edit only the generated client plugin/theme unless the task is explicitly framework-level.
  • Do not patch CoreX framework internals for client-specific design. Brand restyling is tokens/style variations; structural changes are client theme template-part overrides. (See CoreX UI, Company Kit & client ownership.)
  • Keep durable context in files (the client site’s PROGRESS.md/DECISIONS.md), not in chat history.
  • Do not create worktrees unless the owner approves; if a required guard skill is missing, install it before validating.

Client sites ship with their own agent instructions

Section titled “Client sites ship with their own agent instructions”

A site generated by wp corex make:site includes its own governance files — AGENTS.md, CLAUDE.md, README.md, PROGRESS.md, DECISIONS.md — scoped to that site, with its safe-edit boundary and its build/test/deploy and asset-optimization commands. An agent working in a client site should read those files first; they take precedence for that site.

Privacy

Section titled “Privacy”

Never put a real client/company name into the CoreX framework repo, docs, examples, tests, fixtures, or changelog. Use a neutral placeholder (this documentation uses Acme). The real client name belongs only inside the generated client site the owner intentionally creates.