What problem does it solve? When an AI agent implements a driver from a clean-room specification, it may be tempted to read the original encumbered source (Linux, U-Boot, TF-A) when the spec has gaps, contaminating the entire clean-room process and invalidating the legal provenance of the ported code. This Skill prevents, detects, and responds to that contamination. ## Core Features & Use Cases - Layered enforcement: Ships a PreToolUse hook, permission deny rules, a sandboxed restricted subagent definition, and standing AGENTS.md rules that together block reads of encumbered source across file, shell, web, and MCP tool paths. - Spec-gap protocol: Gives the implementing agent a sanctioned, low-cost path (append to docs/spec-gaps/, mark TODO(spec-gap)) so it never needs to consult the reference source. - Session auditing and evidence: The session_audit.py script scans transcripts, artifacts, and SQLite conversation stores for blocked targets, GPL license markers, and code-shaped network payloads, producing a provenance report for pre-merge review. - Use Case: A team porting a USB controller driver to a new OS runs implementation sessions under this Skill; when the agent attempts to fetch a kernel.org page, the hook blocks it, logs the attempt, and redirects the agent to file a spec-gap instead. ## Quick Start Ask the agent to implement the driver described in docs/<device>-spec.md under clean-room rules, filing spec-gaps instead of reading any Linux or U-Boot source.
