Engram Business-Rules Guardrails
Product and business-rule guardrails for Engram's sync, permission, and memory semantics.
Skill definition does not involve sensitive data handling or overreaching operations; primarily instructive rules. Although the repository has security policy, the skill path itself lacks clear mechanisms for user confirmation or least privilege, and publisher identity is unverified. Deductions: skill itself does not demonstrate data-flow transparency or recovery mechanisms; publisher identity unverified.
Static review without execution; skill is primarily instructive text lacking self-contained scripts or reproducible key paths. CI exists but no evidence that skill itself is reliable. Deduction: no execution verification; skill text not directly concrete.
Clear trigger conditions and purpose, but non-fit scenarios not explicit, and no dependency on overseas services relevant to mainland China. Deduction: boundary conditions insufficiently detailed.
Skill has basic structure and metadata, but lacks installation/dependency notes, changelog, and versioning. Deduction: maintenance responsibility and update path unclear.
Value is clear, but cannot statically verify actual completion of user tasks. Deduction: lack of evidence for effective application.
CI workflows and test configs exist, but skill itself not verified. Deduction: static review cannot confirm tests cover skill's actual paths.
- This skill is only business-rule guidance without executable operations; actual use must ensure underlying implementation complies.
- Publisher identity unverified; maintain risk awareness when using.
- Skill does not provide changelog or versioning; recommend monitoring repository updates.
What does this skill do, and when should you use it?
This skill defines product and business-rule guardrails for Engram, a persistent memory system for AI coding agents. It guides developers on implementing changes that affect sync behavior, project controls, permissions, and memory semantics. The skill emphasizes a local-first default model, org-wide security controls in the cloud, enforceable sync policies, real (not fake) UI toggles, and deterministic and testable data visibility. It includes concrete sync rules such as enrollment controlling what may sync, cloud pause controlling what the org allows, failing loudly when policy blocks sync, and preserving auditability.
This skill provides a set of rules to follow when modifying Engram, specifically:
- Keep local-first as the default mental model.
- Ensure org-wide security controls live in cloud, not only local clients.
- Ensure project sync policy is enforceable server-side if meant for admins.
- Require UI controls to map to real business rules, no fake toggles.
- Ensure data visibility and sync permissions are deterministic and testable.
- Define sync rules: enrollment controls what may sync; cloud pause controls what the organization allows; when policy blocks sync, fail loudly rather than drop data silently; preserve auditability when admin policy changes behavior.
Trigger: any change affecting sync behavior, project controls, permissions, or memory semantics.
- When a developer is modifying Engram's enrollment, sync, or auth logic and needs to ensure the change aligns with product rules.
- When implementing project-level or org-level policy, such as deciding which data stays local vs. syncs to cloud.
- When adding admin controls or cloud features, needing to enforce security controls server-side.
- When adjusting UI controls that affect data visibility and sync permissions, to avoid fake toggles.
What are this skill's strengths and limitations?
- Provides clear product guardrails preventing common mistakes like fake UI toggles and silent data loss.
- Emphasizes security and auditability, critical in memory systems.
- Rules are concise and actionable for quick reference during development.
- As part of larger Engram ecosystem, benefits from active maintenance and documentation.
- Limited scope as standalone rules; it provides high-level guidance without technical implementation details.
- Actual integration and auto-loading mechanics of the skill are not described in the SKILL.md.
- License mismatch: repo is MIT, but skill declares Apache-2.0, which may need clarification.
- Maintenance status is not explicitly stated, but repo shows active development.
How do you install this skill?
This is one of 22 skills bundled in the Engram repository, located at skills/business-rules/SKILL.md. To use it, follow Engram's general installation: install via Homebrew (brew install gentleman-programming/tap/engram) or clone the GitHub repo. The skill-specific installation steps are not documented; it can be assumed to be used as part of the Agent Skills directory structure.
How do you use this skill?
Reference this skill during any change that affects sync, project controls, permissions, or memory semantics. For such changes, prompt for design based on the skill's product and sync rules, e.g., 'Per the engram-business-rules skill, how should I implement a policy where admins can pause sync from the cloud?' or 'Does my sync change handle blocked syncs deterministically and auditably?'